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FOREWORD 
THE AIRPLANE ACCIDENT INVESTIGATION BUREAU OF ETHIOPIA 


TheEthiopian Airplane Accident Investigation Bureau (EAIB) is the investigation authority in Ethiopia 
responsible to the Ministry of Transport and Logistics for the investigation of civil Airplane accidents and 
serious incidents in Ethiopia. 


The mission of the EAIB is to promote aviation safety through the conduct of independent, separate 
investigations without prejudice to any judicial or administrative action consistent with Annex 13 to the 
Convention on International Civil Aviation. 


The EAIB conducts the investigations in accordance with the proclamation No 957/2016 and Annex 13 to the 
Convention on International Civil Aviation Organization, which governs how member States of the 
International Civil Aviation Organization (ICAO) conduct Airplane accident investigations internationally. 


The investigation process involves the gathering, recording and analysis of all available information on the 
accidents and incidents; determination of the causes and/or contributing factors; identification of safety 
issues; issuance of safety recommendations to address these safety issues; and completion of the investigation 
report. Іп carrying out the investigations, the EAIB will adhere to ICAO's stated objective, which is as follows: 


"The sole objective of the investigation of an accident or incident shall be the prevention of accidents and 
incidents; it is not the purpose of this activity to apportion blame or liability". 
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І. ORGANISATION OF THE INVESTIGATION 


On 10% March 2019 at around 05:47UTC, the FDRE Ministry of Transport& Logistics and EAIB were informed 
the loss of radio and radar contact with flight ET 302 a few minutes after take-off from Addis Ababa Bole 
International Airport. 


After having established without doubt that the Airplane had disappeared, the Ethiopian Authorities launched 
a technical investigation team. In accordance with Article 26 of the Convention and ICAO Annex 13 "Airplane 
Accident and Incident Investigation", an Investigation Committee (IC) from Ethiopian EAIB investigators was 
formed by a ministerial decree issued by the Minister of Transport& Logistics in order to conduct the 
investigation. An investigator-in-charge (IIC) was designated in the same decree to lead and initiate the 
investigation immediately. As per Annex 13 provisions, in the investigation participated: 


ECAA and Ethiopian Airlines Group - Technical Advisors to EAIB 

NTSB - Accredited Representative State of Design and Manufacturer 

BEA - Accredited representative, State which provided facilities & experts for the read out of DFDR & CVR and 
EASA- Accredited representative during the preliminary report only 


As per the Ethiopian Government decision and agreement between the EAIB and the French Bureau 
d'Enquétes et d' Analyses pour la sécurité de l'aviation civile (BEA), the DFDR and CVR were read at the BEA 
facilities at Le Bourget, near Paris, France. Both recorders were transported directly to the BEA under the 
custody of the State of Occurrence accompanied by members from the EAIB and readings were performed by 
BEA personnel in association with and under the direct supervision of the IIC. At the request of Ethiopia and as 
per Annex 13 Article 5.23, BEA has appointed an accredited representative and assisted EAIB for the analysis 
of FDR data. 


For this investigation, working groups were initially built up as follows: 

* Operations 

е Maintenance & Airworthiness 

* Power plant 

• DFDR and СУК 
Later on the group merged into operations, systems and DFDR- CVR groups until thisinvestigationreport 
prepared. 
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A Search & Rescue (SAR) team performed search by Ethiopian Air force, Ethiopian Airlines Group and 
Abyssinian flight service. Search operations were conducted in full coordination with Federal, Regional police 
and other Government bodies. 


II. ACRONYMS 


AC Advisory Circular 

ACO Airplane Certification Office 
ADIRS Air Data Inertial Reference System 
ADIRU Air Data Inertial Reference Unit 
ADM Air Data Module 

AD Airworthiness Directive 

ADR Air Data Reference/Air Data System 
ADC Air Data Computer 

ADS Air Data System 

AFCS Automatic Flight Control System 
AFDS Autopilot Flight Director System 
AGB Accessory Gear Box 

AGL Above Ground Level 

AFM Airplane Flight manual. 

EAIB Accident Investigation Bureau 
Alpha vane Angle of Attack Vane 

AMM Airplane Maintenance Manual 
AML Airplane Maintenance Log 
ARM Armed 

AND Airplane Nose Down 

ANU Airplane Nose Up 

AOAS Angle Of Attack Sensor 
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AOC Air Operator Certificate 

A/P Auto Pilot 

APU Auxiliary Power Unit 

ARINC Aeronautical Radio Incorporated 

A/T Auto-Throttle 

ATC Air Traffic Control 

ATPL Airline Transport Pilot Licence 

BASOO Boeing Aviation Safety Oversight Office 

BEA Bureau d'Enquéteset d'Analyses pour la sécurité de l'aviation civile 

BOV Bias Out of View 

CAS Computed or calibrated Air Speed 

CG Center of Gravity 

CGD Crew General Description 

CGO Cargo 

CLB Climb 

CMD Command - Auto pilot may engage in command (CMD) or in Control Wheel 
Steering (CWS) 

CPL Commercial Pilot Licence 

CPN Certification Project Notification 

CRM Crew Resource Management 

CSMU Crash Survivable Memory Unit 

CVR Cockpit Voice Recorder 

CWS Control Wheel Steering 

DFDAU Digital Flight Data Acquisition Unit 

DFDR Digital Flight Data Recorder 

DFCS Digital Flight Control System 

DME Distance Measuring Equipment 

DPC Display Processing Computer 
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DSCO Deligation Systems Certification Office 
DU Display Unit 

EAIB Ethiopian Accident Investigation Bureau 
EASA European Aviation Safety Agency 

ECAA Ethiopian Civil Aviation Authority 

ECAB Engineering Cab (Flight Simulator) 
ECARAS Ethiopian Civil Aviation Rules and Standards 
ECO Engine Certification Office 

EDFCS Enhanced Digital Flight Control System 
EEC Electronic Engine Control 

EFS Elevator Feel Shift 

EFIS Electronic Flight Instrument System 
EGPWS Enhanced Ground Proximity Warning System 
EGT Exhaust Gas Temperature 

EIS Entry into Service 

EWIS Electrical Wiring Interconnection System 
FAA Federal Aviation Administration 

FAR Federal Aviation Regulation 

FCC Flight Control Computer 

FCOM Flight Crew Operating Manual 

FCTM Flight Crew Training Manual 

F/D Flight Director 

FCTR Flight Control Test Rig 

F/O First Officer 

FOM Flight Operation Manual 

FDAU Flight Data Acquisition Unit 

FDR Flight Data Recorder 
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FL Flight Level 

FMA Flight Mode Annunciator 

FMC Flight Management Computer 
FTA Fault Tree Analysis 

FW Failure Warning 

GA Go Around 

GE General Electric 

GPS Global Positioning System 

GPWS Ground Proximity Warning System 
GVI General Visual Inspection 

HAAB Addis Ababa Bole 

HDG Heading 

HPC High Pressure Compressor 

HPT High Pressure Turbine 

HUD Head Up Display 

IAS Indicated Airspeed 

IC Investigation committee 

ICAO International Civil Aviation Organization 
IFSO In-flight Security Officer 

IIC Investigator In Charge 

IR Instrument Rating 

IRS Inertial Reference System 

ISFD Integrated Standby Flight Display 
ILS Instrument Landing System 
KCAS Knots Calibrated Airspeed 

Kt Knots 

LBS Pound 
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LGT Light 

LGW Landing Weight 

LMC Last Minute Change 

LPC Low Pressure Compressor 

LE Leading Edge 

LH/RH Left Hand, Right Hand 

LNAV Lateral Navigation (A/P or F/D mode) 
LPT Low pressure Turbine 

MAC Mean Aerodynamic Chord 

MCAS Maneuvering Characteristics Augmentation System 
MCO Military Certification Office 

MCP Mode Control Panel 

MCP Master Certification Plan 

MEL Minimum Equipment List 

MLB Maintenance Log Book 

MMO Mach number - Maximum Operating value 
MRO Maintenance Repair & Overhaul 

MPL Multi crew Pilot Licence 

MSA Minimum Safe Altitude 

N/A Not Applicable 

NDT Non Destructive Testing 

NCD No Computed Data 

NM Nautical Miles 

NOTAM Notice to Air Men 

NTSB National Transportation Safety Board 
OMB Operational Manual Bulletien 

OM Operation Manual 
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ODA Organization Designation Authorization 

PC Personal Computer 

PCU Power Control Unit 

PF Pilot Flying 

PFD Primary Flight Display 

PLI Pitch Limit Indicator 

PNL Programme Notification Letter 

QNH Altimeter sub-scale setting to obtain elevation when on the ground 

QRH Quick Reference Handbook 

RA Radio Altitude 

RH Right Hand 

RUDOL Navigation Waypoint near Lake Turkana, on the Ethiopia/Kenya border 
(formerly Lake "Ruduolf") 

RWY Runway 

SAE Safran A/C Engine 

SAR Search and Rescue 

SAT Static Air Temperature 

SHALA Lake "Shala" 

SMYD Stall Management and Yaw Damper 

SMS Safety Management System 

SPD Speed 

SRM Safety Risk Management 

STAB Trim Stablizer Trim 

SSEC Static Source Error Correction 

SSA System Safety Analysis 

SSM Status Sign Matrix 

STS Speed Trim. System 

SWS Stall Warning System 
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TAS True Air Speed 

TAF Terminal Aerodrome Forecast 

TAT Total Air Temperature 

TC Type Certifiate 

TCDS Type Certificate Data Sheet 

TE Trailing Edge 

TEM Threat and Error Mmanagement 
THR HLD Throttle Hold (A/T mode) 

TGB Transfer Gear Box 

TO Take Off 

TOGA Take Off / Go Around 

TRA Throttle Resolver Angle 

TWY Taxi Way 

UPRT Upset Prevention and Recovery Training 
UTC Coordinated Universal Time 

VHF Very High Frequency 

VFR Visual Flight Rule 

VMO Velocity - Maximum Operating value 
VNAV Vertical Navigation (A/P or F/D mode) 
VOR VHF Omnidirectional Range 

VS Vertical Speed 

YD Yaw Damper 
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III. SYNOPSIS 


The Accident was notified by the operator/ATC to the Accident Investigation Bureau the same day right after 
the accident occurred. 


TABLE1: SYNOPSIS 


Airplane Boeing 737-МАХ8 registered ЕТ-АУ) 

Date and time 10 March 2019 at 05:44 UTC 

Operator Ethiopian Airlines Group 

Place of the Accident 28 NM South East of Addis Ababa, Bole International Airport 

Type of flight Scheduled passengers flight ET-302 
Addis Ababa (Ethiopia) - Jomo Kenyatta (Kenya) 

Persons on board Captain; First-Officer; 5 Cabin Crew; 1 In Flight Security Officer (1Е50); 
149 passengers from different countries with different nationalities 

Consequences and damage | 157 fatalities; Airplane destroyed 


IV.EXECUTIVE SUMMARY 


On March 10, 2019, at 05:38 UTC, Ethiopian Airlines flight 302, Boeing 737-8(MAX), ET-AV], took off from 
Addis Ababa Bole International Airport bound to Nairobi, Kenya Jomo Kenyatta International Airport. 


ET302 was being operated under the provisions of the Ethiopian Civil Aviation Regulations (ECARAS) as a 
scheduled international flight between Addis Ababa Bole International Airport (HAAB), Ethiopia and Jomo 
Kenyatta Int. (HKJK) Nairobi, Kenya. It departed Addis Ababa with 157 persons on board: 2 flight crew (a 
Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular passengers. 


At 05:36:12 the Airplane lined up on runway 07R at field elevation of 7,656 ft with flap setting of 5 degrees 
and a stabilizer trim setting of 5.6 units!. Both flight directors (F/D) were ON with LNAV and VNAV modes 
armed. At 05:37:17the F/O reported to Tower ready for takeoff andat 05:37:36ATC issued take off clearance 
to ET-302 and advised to contact radar on 119.7MHz. 


The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AOA). During 
takeoff roll, the engines stabilized at about 9496 N1. Shortly after liftoff, the left Angle of Attack sensor 
recorded value became erroneous and the left stick shaker activated and remained active until near the end of 
the recording. In addition, the airspeed and altitude values from the left air data system began deviating from 
the corresponding right side values. The left and right recorded AOA values began deviating. Left AOA 
decreased to 11.1? then increased to 35.7? while the right AOA indicated 14.94?. Then after, the left AOA 


Stabilizer trim setting of 5.6 units!. 
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valuereached 74.5? in 34 seconds while the right AOA reached a Maximum value of 15.3?, the difference 
between LH and RH AOA was59°and near the end of the recording it was 490, 

At 05:39:30, the radar controller identified ET-302 and advised to climb FL 340 and when able to turn right 
direct to RUDOL. At 5:39:51, the selected heading increased from 072? to 197°. 


After the flaps were fully retractedthelstautomatic nose-down trim activated and engaged for 9 
secondspositioning the stabilizer trim to 2.1 units. The pilot flying pulled to pitch up the Airplane with a force 
more than 90lbs. He then applied electric trim-up inputs. Five seconds after the end of these inputs a second 
automatic nose-down trim activated. 


At 5:40:22, the second automatic nose-down trim activated. Following nose-down trim activationGPWS DON'T 
SINK sounded for 3 seconds and "PULL UP" also displayed on PFD for 3 seconds.At 05:40:43, approximately 
five seconds after the end of the crew manual electrical trim up inputs, a third automatic trim nose-down was 
recorded but with no associated movement of the stabilizer. 


At 05:40:50, the captain told the F/O:"advise we would like to maintain one four thousand. We have a flight 
control problem". The F/O complied and the request was approved by ATC. Following the approval of the ATC, 
the new target altitude of 14,000ft was set on the MCP.The Captain was unable to maintain the flight path and 
requested to return back to the departure airport.At 05:43:21, approximately five seconds after the last 
mainelectric trim up input, an automatic nose-down trimactivated for about 5s. The stabilizer moved from 2.3 
to 1 unit. The rate of climb decreased followed by a descentin 3s after the automatic trim activation. 


One second before the end of the automatic trim activation, the average force applied by the crew decreased 
from 100 lbs to 78 lbs in 3.5 seconds. In these 3.5 seconds, the pitch angle dropped from 0.5? nose up to -7.8° 
nose down and the descent rate increased from -100 ft/min to more than -5,000 ft/min. 

Following the last automatic trim activation and despite calculated column force of up to 110lbs, the pitch 
continued decreasing. The descent rate and the airspeed continued increasing between the triggering of the 
4th automatic trim activation and the last recorded parameter value. At the end of the flight, Computed 
airspeed values reached 500Kt, Pitch values were greater than 40° nose down and descent rate values were 
greater than 33,000 ft/min. Finally, both recorders stopped recording at around 05 h 43 min 44s. 


At 05:44 The Airplane impacted terrain 28 NM South East of Addis Ababa near Ejere(located 8.8770 N, 
39.2516 E.) villageat a farm field and created a crater approximately 10 meters deep (last Airplane part found) 
with a hole of about 28 meters width and 40 meters length. Most of the wreckage was found buried in the 
ground; small fragments of the Airplane were found scattered around the site in an area by about 200 meters 
width and 300 meters long. The damages to the Airplane were consistent with a high energy impact. АП157 
persons on board: 2 flight crew (a Captain and a First Officer), 5 cabin crew and one IFSO, 149 regular 
passengers were fatally injured. 
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1. FACTUAL INFORMATION 


1.1 HISTORY OF THE FLIGHT 


On March 10, 2019, at about 05:44 UTC?, Ethiopian Airlines flight ET-302, a Boeing 737-МАХ8, Ethiopian 
registration ЕТ-АУ), crashed shortly after takeoff from Addis Ababa Bole International Airport (НААВ), 
South East of Addis Ababa near Ejere Town. The flight was a regular scheduled international passenger 
flight from Addis Ababa to Jomo Kenyatta International Airport (HKJK), Nairobi, Kenya. There were 149 
passengers and 8 crews on board. All were fatally injured, and the Airplane was destroyed. 


The following chronological history of flight was reproduced from verified data retrieved from the Airplane 
DFDR, CVR, Air Traffic Control (ATC) radar recordings and transcripts. According to the CVR data and the 
control column forces recorded in the DFDR, the captain was the pilot flying. 


Phase1:From takeoff to Autopilot engagement (from 5h 36 min 12 s until 5h 39 min 23 s) 


At 5:36:12 the Airplane lined up on runway 07R at field elevation of 7,656ft with a flap setting of 5 degrees 
and a stabilizer trim setting of 5.6 units*.Both flight directors (F/D) were ON with LNAV and VNAV modes 
armed. Auto throttle (A/T) was armed. 


At 05:37:17the F/O reported to Tower ready for takeoff. ATC advised the crew to stand by. The F/O 
confirmed standing by. 


At 05:37:36, ATC issued take off clearance to ET-302 and told the crew to contact radar on 119.7 MHz when 
airborne. Following the take-off clearance, the crew advanced the throttle and checked the stability of the 
engines parameters. 


At 05:37:51, take-off roll began from runway 07R 


At 5:37:53, the crew engaged the automatic takeoff and climb sequence (F/D TO mode and A/T TO 
sequence) by pushing the TOGA switch and the A/T moved the throttle forward. 


The takeoff roll and lift-off was normal, including normal values of left and right angle-of-attack (AOA). 
During takeoff roll, the engines stabilized at about 94% N1. From this point for most of the flight, the N1 
Reference remained about 94%. 


“all times listed is Universal Coordinated Time (UTC), as recorded on the FDR. 
3The value of 5.6 units was a consistent setting for the takeoff. The stabilizer positions ranges from 0 unit nose down to 17 unit nose up. A 
value of 4 units corresponds to a neutral position. 
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At 05:38:14the F/O called 80Kt. 
At 05:38:32 Automatic V1 call 
Once Vr was reached, at 05:38:34the F/O called "rotate" and the Airplane liftoff 


At 05:38:43 “positive rate" confirmed, at about 50ft radio altitude, the flight director roll mode changed to 
LNAV. 


At 05:38:44, shortly after liftoff, the left and right recorded AOA values began deviating. Left AOA decreased 
to 11.1° then increased to 35.7° while value of right AOA indicated 14.94° (point “A” in Figure 1). Then 
after, the left AOA value reached 74.5° in % seconds while the right AOA reached a Maximum value of 15.3°, 
the difference between the left and the right AOA values decreased from 59° to approximately 49° near the 
end of the recording, prior to the final dynamic behavior that was exhibited. 


- As a result of the erroneous left AOA value, the left stick shaker activated and the red and black stripe 
band exceeded the displayed LH airspeed. The left stick shaker remained active until near the end of the 
recording. 


- Right and left altitude and airspeed indications started diverging (the computations of LH values were 
affected by erroneous LH AOA values). From that time: 


- LH displayed altitude values became lower than the actual pressure altitude values displayed on the RH 
side. 


- LH displayed airspeed values became lower than the actual airspeed values displayed on the RH side. 


- The left pitch bar and the left Pitch Limit Indicator (PLI) rapidly moved downward (left pitch bar to -10°, 
the PLI to around 0°)4. 


- The captain reduced the Pitch from 15° to around 7-8°. 


At 5:38:48, the “MASTER CAUTION” and “ANTI-ICE” lights on the glare shield Illuminated. The F/O called out 
“Master caution/anti ice”. It was acknowledged by the Captain. 


“A note in the QRH -Non Normal Manoeuvres “Approach to Stall or Stall Recovery” requests not to use the flight director commands during 
the stall recovery. 
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4t 05:38:51: 


- The Pitch F/D bars disappeared ("Bias Out of View" - BOV) on both RH and LH Primary Flight Displays 
(PFD), as the threshold for the comparator between LH and RH F/D pitch display below 400ft RA was 
reached. 


- On the LH PFD, invalid operational speeds, corrupted by the erroneous left AOA value, were displayed 
(LH stick shaker speed and LH minimum operation speed being greater than the LH computed 
airspeed).The current LH airspeed was inside the barber pole of the speed tape (black and red stripes 
underlying a dangerously too low speed or dangerously too high speed). 


At 05:38:56, the captain stated "command" to engage the autopilot (A/P). A/P disconnect warning sounded 
for 2 seconds. 
At 5:38:59, as the Airplane crossed 400ft Radio Altitude, VNAV mode engaged. From that time, the F/D TO 
mode and associated pitch comparatorwas no longer active and the F/D pitch bars reappeared. 

- VNAV pushbutton light illuminated. 

- LNAV pushbutton light illuminated again. 
At 05:39:01, the captain called out "Command" again.A/P disconnection warning sounded for 2 seconds. The 


captain asked "what's going on?" 


At 05:39:06, the captain requested the F/O to contact ATC radar (point B). The F/O contacted the radar 
controller, calling out on"SHALA 2A departure, crossing 8,400ftclimbing 320". At the time the RH baro- 
corrected altitude recorded values reached 8,400ft, the LH baro-corrected altitude values were about 400ft 
lower. During that communication, at 5:39:14 HDG select mode was manually engaged. The heading 
displayed on the MCP was 72? which is consistent with runway heading for RWY 07R. 


During the first phase of flight, the Airplane was kept in trim through the use of the crew-initiated main 
electric trim commands, there was limited force required on the control column. 


BeforeCMD A engaged, the stabilizertrim position was around 5.6 units, with elevator positions around 4? 
(consistent with the elevator neutral position for the stabilized flight condition). 
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ET-AVJ 
Phase 1 


b^ 22 с, 2 : ^ э : 
FIGURE 1: PHASE1 FROM TAKEOFF ТО AUTOPILOT ENGAGEMENT 


Phase 2: Under Autopilot engagement (from 5h 39 min 23 s until 5h 39 min 56s) 


At 05:39:23, at about 1,000 feet Radio Altitude, the crew attempted a third auto-pilot engagement (point C). 
CMD A (LH autopilot) engaged in HDG/VNAV modes. The pitch trim position started to decrease to 4.6 units. 
Six seconds after the autopilot engagement, there were small amplitude roll oscillations (* 5? of bank) 
accompanied by lateral acceleration, rudder oscillations and slight heading changes. This was most likely the 
result of reduced yaw damper gains due to erroneous LH AOA values.These oscillations also continued after 
the autopilot was disengaged. 


While the autopilot was engaged, systems continued to be suppliedby the erroneous LH AOA values. As a 
result, the LH SMYDC? computed erroneous LH minimum operational speed values which were higher than 
the current LH computed airspeed and the FMC selected airspeed. As the LH minimum operational speed 
was greater than the FMC selected speed at that time, speed reversion occurred (selection of the erroneous 


ЕСІ Management апа Yaw Damper Computer 
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minimum operational speed as target speed) and autopilot commanded a pitch down to accelerate towards 
the erroneous minimum operating speed. 


At 05:39:30, the radar controller identified ET-302 and cleared the flight to climb FL 340 and when able to 
turn right direct to RUDOL. 


At 05:39:37, the F/O read back the clearance to ATC. 


At 5:39:38: 800ft above field elevation was reached (with the reference of the LH baro-corrected altitude 
reference). As per automatic takeoff and climb sequence design, the A/T switched to the ARM mode. 


At 05:39:42, the crew engaged Level Change mode and set MCP speed to 238Kt. 
At 05:39:45, flaps retraction was commanded by the captain and the F/O complied. 
At 5:39:51, selected heading increased from 072? to 197°. 


At the same time, the captain told the F/O“advice we are unable, request to maintain runway heading". The 
F/O didn't acknowledge nor complied with the captain’s request. 


At 05:39:56, the A/P disconnected automatically (point D) after remaining engaged for 32 seconds as the 
following logic conditions were reached: 


e Climb command with climb rate too low for five seconds 


At the beginning of this phase, the Airplane was climbing with an increasing vertical speed and a trend to 
pitch up. Oncethe autopilot engaged it tried to increase the airspeed, because of the minimum speed 
reversion (erroneous LH minimum operational speed based on erroneous LH AOA value). 


The A/P initially trimmed nose down 0.5 units. This nose-down trimstopped the increase in pitch 
at8.4?.Then the pitch started to decrease. It also stopped increasing in vertical speed at 1,500 ft/min, which 
then also started to decrease. 


The engagement of the LVL CHG mode and the new associated target speed most probably led to several 
transient AP mode computations leading to the decrease in vertical speed to stop at around 450 ft/min and 
the pitch values to stabilize at around 4°. After that, the erroneous excessive minimum speed related to the 
erroneous AOAtriggered again an AP pitch down command to increase the speed. After reaching a Maximum 
altitude of around 9,100 ft (RHbaro corrected altitude) during this phase, the Airplane started descending, 
triggering the autopilot to disconnect. 


At the end of this phase, the pitch angle was around 1°, the stabilizer was at 4.6 units and the vertical speed 
was around -1,400 ft/min Flaps were still moving up. 
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ET-AVJ 
Phase 2 


FIGURE 2: PHASE 2 DURING AUTOPILOT CONTROL 


Phase 3: From A/P disconnect to stabilizer trim cutout (from 5h 39 min 56s until 5h 40 min 38s) 


Atthe time A/P disconnected, LH pitch F/D bar disappeared due to the same logic conditions that caused the 
APdisconnection. The LH pitch F/D bar appeared and disappeared several times as the climb rate varied 
above and below the minimum threshold.The PF applied an increasing force towards pitch up. 


Between5:39:59 and 5:40:02 the captain said:”Request to maintain runway heading; "We are having flight 
control problems". 


During this transmission: 


At 5:40:00: As the flaps reached the up position with the autopilot OFF and because of the erroneous left 
AOA value, the FCC activated the 1st automatic nose down trim (MCAS) during 9 seconds. Two seconds after 
the MCAS activation, the Captain told the F/O: "We are having flight control problems" (point E). 


Almost at the same time: 


е On the LH PFD, a red and black stripes band was displayed all along the speed tape. It stayed 
displayed until the end of the recording. The LH computed airspeed was 246Kt while the RH 
computed airspeed was 267Kt. 

е GPWS DON’T SINK warning sounded for 3 seconds. 

e PULL UP message appeared on both PFD for 14 seconds. 
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At 5:40:04, the F/O reportedto ATC that they were unable to maintain SHALA 1A 


At 5:40:09, the MCAS stopped.At the end of the MCAS activation, the stabilizer position was 2.1 units with 
the PF pulling to pitch up the Airplane, with a force of around 90165. 


At 5:40:11, the captain again told the F/O "request runway heading"... The F/O complied. This request was 
approved by ATC. 


At 5:40:14, the Captain trimmed nose up for about 2 seconds with the main electric trim switches located on 
the control wheel. The stabilizer reached 2.3 units. 


At 5:40:17, the captain said "OK, Flaps up speed". 


At 5:40:22, Five seconds after the end of the Captain's trim inputs a secondautomatic nose-downtrim 
(MCAS) occurred (point F). Duringthe nose-down trim activation, GPWS DON'T SINK sounded and PULL UP 
was displayed on the PFDs. The Captain said "cut it".Manual electric trim up inputs started at 5h 40min 28s 
for 9s, which stopped the second automatic nose-downtrim activation two seconds before its expected end 
(automatic nose-down trim activated for around 7 s instead of 9 s). The trim up inputs from the Captain 
stopped at 5 h 40 min 37safter the GPWS alerts disappeared. 


The F/Othen twice suggested "stab trim cut out?" The Captain replied "yes yes do it". The stab trim cut-out 
switches were most likely put in the cut-out positionat about 5 h 40 min 38 s(point G Figure 3). At this 
time: 


- the stabilizer position was at 2.3 units, 


- The Airplane was 1,500 ft above the airfield elevation (computed from the RH pressure altitude) but, 
the LH pressure altitude was 1,000ft lower. 


- The actual computed airspeed was 332Kt (value displayed on RHPFD) while the erroneous value 
displayed on the LH PFD was 308Kt. 


- Pitch attitude was around 2.5? with a vertical speed of 350 ft/min. 


- Roll oscillations continued and the heading slightly increased. At the end of the phase, the Airplane 
heading was around 80°. 


During this phase: 

At the beginning, FMC detected a significant difference between the RH and LH True Airspeed (erroneous LH 
ADIRUcomputed values due to erroneous LH AOA value). From this time, FMC did not send any valid 
commandto A/T. The A/T stayed in the Arm Mode. The loss of valid FMC command did not triggeran explicit 
alert but did result in the FMA continuing to display “ARM” instead of changing to “М1” as would normally be 
expected. 
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As a result of the erroneous LH AOA value and the increasing airspeed, SMYDC 1 computed LH minimum 
operational speed and LH stick shaker speed greater thanVMO (340Kt) without any alert or invalidity 
detection. 


ET-AVJ 
Phase 3 


A 


FIGURE3: PHASE 3 FROM A/P DISCONNECT TO STABILIZER TRIM CUTOUT 


Phase 4: flight while the stab trim cutout switches were in the cutout position (from 5h 40 min 38 s 
until 5h 43 min 11 5) 


At 05:40:43: approximately five seconds after the end of crew manual electrical trim up inputs, a third 
automatic nose-down trim (MCAS) triggered. There was no corresponding motion of the stabilizer, which is 
consistent with the stabilizer trim cutout switches beingin the “cutout” position 


At the beginning of this phase, the captain succeeded in pitching up the Airplane, the vertical speed value 
was 1,800 ft/min, increasing. 


At 5:40:45, the captain repeatedly requested the F/O to pull up with him. Both pilots applied force on the 
control column. 


From that time until the end of this phase, pitch values oscillated between 7° nose up and -2° nose down. 
Pitch increased when both pilots applied forces, pitch decreased when a single pilot applied force (force 
oscillated between 80 lbs and 110lbs). The vertical speed variations followed the variations of the pitch 
angle, with vertical speeds oscillating between -2,500 ft/min and + 4,400 ft/min. 
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At 05:40:50, crossing 9,500 ft (RH Baro corrected altitude - erroneous, LH baro corrected altitude: 8,500 ft), 
the captain told the F/O:"advise we would like to maintain one four thousand®. We have flight control 
problem". The F/O complied. 


The request was approved by ATC. The ATC asked about intentions. The F/O answered he would call back. 
Following the approval of ATC, the new target altitude was set on the MCP. 


At 5:41:21 the RH speed exceeded 340Kt and the overspeed warning sounded(point H).The captain said 
"the speed", the F/O replied: "Captain! Speed" The overspeedwarning remained active until the end of the 
recording as RH airspeed remained above VMO. The RH speed values stabilized between 360Kt and 375Kt and 
on the LH PFD, the LH computed airspeed oscillated between 335 and 350Kt. At this time, the altitude of the 
Airplane was oscillating around 10,800ft. 


At 05:41:23, the selected altitude reached 14,000 ft. The captain called out "speed", which was 
acknowledged by the F/O. 


From 05:41:31 until 05:41:40, the captain asked the F/O to pitch up with him. 


At 05:41:47, the Captain asked the F/O if the trim was functional. The First-Officer replied that the trim was 
not working and asked if he could try it manually. The Captain told him to try (Point I Figure 4). 


At 5:41:56 the F/O stated "It is not working". The captain replied "OK keep with me" and repeated on 
several occasions "keep with me" with sounds of strains in his voice. He added that they should go up to 
14,000 ft. 


At 5:42:12, the Captain requested a vector to return to the airport (point J). 


At 5:42:15, the F/O requested "Radar Ethiopian three zero two request vector to return to home ” Following 
ATC instruction to turn to 260°, a new target heading of 262 ? was set.The Airplane heading at that time was 
102°. 


At 5:42:47, the captainsaid« Ok, what was it? Master Caution? The F/O says« Master caution? » The captain 
asked the F/O to verify. The FDR data at this time is consistent with the crew pressing the MASTER 
CAUTION recall button to review the existing faults.The F/O answered “Master Caution Anti Ice". The 
Captain said"Left Alpha Vane". The F/Oacknowledged"Left Alpha Vane". 


614,000 ft is the Minimum Safe Altitude in that sector 
7At this time, the trim value is -2.7 units and the CAS is 340kt. 
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At 5:43:04, the Captain asked "Should we pitch together? Pitch is not enough" with a straining voice he then 
said “Put them ир”. 


During this phase, the crew was applying an average force of 94 lbs on the control column. 


At the end of the phase: 


- The Airplane was at an altitude of 6,200 ft above the airfield elevation (computed from the RH 
pressure altitude). LH altitude values were 1,250 ft lower. 


- Computed airspeed was around 367Kt (RH value), LH erroneous value was 344 Kt. 
- The pitch angle ofthe Airplane was lower than 1? 
- Тһе vertical speed was around + 125 ft/min and decreasing 


- The bank angle was around 21? right, with a slight trend to increase. 


ET-AVJ 
Phase4 | 


Google Earth 


FIGURE 4: PHASE 4 FLIGHT WHILE THE STAB TRIM CUTOUT SWITCHES WERE IN THE CUTOUT POSITION 


8A click similar to the Stabilizer trim cut-out switches being put back on was heard on the CVR. 
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Phase 5: Stab trim cut out switches back in normal position (point K) until the end of the flight (from 
5h 43 min 11suntil 5h 43 min 44 s) 


At 5:43:11, the crew tried to engage the A/P and A/P warning sounded for 3 s. 


At the time of the A/P engagement attempt, 2 short-time manual electrical trim up inputs were recorded, 
which confirms that the stabilizer cutout switches had been restored to the normal position?; at this time, 
the stabilizer position was 2.3 units. 


At 05:43:21, approximately five seconds after the last main electric trim up input, an automatic nose-down 
trim (4% MCAS) triggered for about 5s (point L). The stabilizer moved from 2.3 to 1 unit. 3 seconds after the 
automatic nose-down trim activation, the vertical speed decreased and became negative.One second before 
the end of the automatic trim nose-down activation, the average force applied by the crew decreased from 
100 lbs to 78 lbs in 3.5 seconds. 


In these3.5 seconds, the pitch angle dropped from 0.5? nose up to -7.8? nose down and the descent 
rateincreased from -100 ft/min to more than -5,000 ft/min. Following the last automatic nose-downtrim 
activation and despite calculated force of up to 180lbs, thepitch continued decreasing. The descent rate and 
the airspeed continued increasing. 


At 05:43:36the EGPWS sounded: "Terrain, Terrain, Pull Up, Pull up" 


The recordings stopped 23 seconds after the activation of the 4% automatic nose down trim. 
At the end of the recording: 
- Computed airspeed values reached 500Kt 


- Pitch values were greater than 40? nose down 
- Vertical speed values were greater than 33,000 ft/min. 


Both recorders stopped recording at around 05 h 43 min 44 s. 


The FDR discrete parameter of the manual electric trim command records command (up or down) only when both stab trim cutout 
switches are in the normal position 
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L = MCAS#4 
4 End of MCAS#4 
% 


FIGURE 5: PHASE 5 STAB TRIM CUT OUT SWITCHES BACK IN NORMAL POSITION 


1.2 INJURIES TO PERSONS 


TABLE: 2 INJURIES TO PERSON 


Injuries Flight Crew | Passengers Totalin Airplane | Others 
Fatal 8 149 157 - 
Serious - - х : 
Minor е - а н 
Мопе - - = a 
TOTAL 8 149 157 - 


1.3 DAMAGE TO AIRPLANE 


The Airplane was destroyed. 


1.4 OTHER DAMAGE 
The farm land was excavated with a deep and wide hole not to be used for further farming. 
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1.5 PERSONNEL INFORMATION 
1.5.1. Flight Crew 


The flight crew consisted of the captain and the first officer, five flight attendants and an In-Flight Security 
Officer (IFSO). All crew were certified in accordance with the ECAA requirements. 


1.5.1.1 Pilot in Command 


The pilot in command was 29 years old. According to Ethiopian Civil Aviation Authority (ECAA) records, the 
Captain's most recent simulator proficiency check was Осіоһегі, 2018. The captain graduated from 
Ethiopian Aviation Academy on July 23, 2010. A review of the captains training records indicated that he 
received his 737-800 First Officer type rating on January 31, 2011 and completed his PIC type rating for the 
737-800 October 26, 2017, B737MAX differences training on 03 July, 2018. 


According to Ethiopian Airlines records, the captain has the following flying experiences: 


PIC has flown as first officer on different airplanes, like B737 from 22 April, 2011 to 06 February 2013 for 
2600hrs, 767 from February 2013, to October, 2014 and B777 and 787 for 2145hrs for consecutive periods. 
From 26 October, 2017 until the end of the event he was a captain on B737 and flew for 1,417 hrs as PIC on 


type. 


TABLE 3: PILOT IN COMMAD INFORMATION 
PILOT IN COMMAND Male,aged 29 


Licenses CPL issued on 23-07-2010 
ATPL issued on 27-07-2017 
Simulator Based training B737-7/800 Renewed on 01-10-18 valid until 30-03-19 


Annual Medical Check Renewed on 12-12-18 valid until 11-12-19 
Rest before Last flight 72 hrs 

AVIATION CARRIER DETAILS 

Student Pilot, EAL Aviation Academy From August 2008 To July2010 
B737-700/800 (First Officer) Qualified on 31-01-11 

B767/757 (First Officer) Qualified on 09-05-13 

B777 (First Officer) Qualified on 04-02-15 
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B787 (First Officer) Qualified on 17-08-15 
B737- 700/800 (Captain) Qualified on 26-10-17 
B737- MAX (Captain) Qualified on 03-07-18 
FLYING EXPERIENCE 
Total Flying Hours 8122:00 hrs 
B737-700/800 4017:00 hrs 
B737-700/800/as PIC 1417:00 hrs 
B737-8 MAX 103:00 
Flying time within last ninety days 266:09 
Flying time within last thirty days 62:00 
Flying time within last seven days 17:43 
Flying time on the day of Occurrence 06minutes 
TRAINING RECORD SUMMARY 
Pilot flying: checkout and simulator training 
TABLE 4: PFTRAINING RECORD SUMMARY 
Date Type of TRG A/C type Training Comment Result 
check Device 
10-04-18 | Proficiency Check | Boeing 737 NG Simulator Completed Good 
satisfactorily 
02-04-18 | Proficiency check | Boeing 737 NG Simulator Proficiently V. good 
executed 
30-09-18 | Proficiency check | Boeing 737 MAX | Simulator Satisfactory 
01-10-18 | Proficiency check | Boeing 737 MAX | Simulator Satisfactorily V. good 
completed 
03-07-18 | Differences Boeing 737 CBT standard 
Training NG/MAX 
NG/MAX 
30-11-18 | Line check Boeing 737 NG Airplane Verygood Satisfactory 
performance 
13-07-18 | Low Visibility Boeing737 MAX | Simulator Very professional V. good 
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The Captain'smost recent simulator proficiency check was conducted on October 1, 2018. Line check was 
performed on 30 Nov 2018. His flying time within the last ninety days before the accident was 266.09 hrs; 


Last thirty and seven days 62.00hrs and 17.43hrs respectively. 


The pilot had a first-class medical certificate with no limitations dated December 12, 2018. A review of the 
medical exam that resulted in the issuance of this certificate showed no vision or hearing deficiencies, and 
on the certificate application, the pilot stated he was taking no prescription or non-prescription medications. 


1.5.1.2 First-Officer 


According to Ethiopian Airlines records, the First-Officer has the following flight experience: 


TABLE 5: FIRST OFFICER INFORMATION 


FIRST OFFICER Male, Aged 25 

License CPL issued on 12-12-18 

Simulator Based training B737-700/800 Renewed on 03-12-18 valid until 02-12-19 
Annual Medical Check Renewed on 30-08-18 Valid until 29-08-19 
Rest Before Last Flight 65 hrs 


AVIATION CARRIER DETAILS 


Student Pilot,EAL Aviation Academy 


From March 2017 to August 2018 


B737-700/800 (First Officer) 


Qualified on 12-12-18 


B737-8 MAX(First Officer) 


Qualified on 12-12-18 


FLYING EXPERIENCE 

Total Flying Hours 361:00hrs 
B737-700/800/MAX 207:26 hrs 
Flying hour last ninety days 207:26hrs 
Flying hour last thirty days 71hrs 
Flying hour last seven days 10:57hrs 
Flying hour on the day of occurrence 06 minutes 


According to ECAA records, the first-officer’s most recent simulator event was listed as a proficiency check 
and occurred on December 3, 2018. His line training/check (conducted in the B737 Airplane) was completed 


on January 31, 2019. 
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The first-officer's ECAA license was permitted to act as first-officer in commercial air transport operations in 
Boeing 737-700/800 dated December 12, 2018 and Boeing 737 MAX dated December 12, 2018 and qualified 
to act in the capacity of first officer effective February 01, 2019. 


The first-officer had a first-class medical certificate with no limitations dated July 30, 2018. A review of the 
medical exam that resulted in the issuance of this certificate showed no vision or hearing deficiencies, and 
on the certificate application, the pilot stated he was taking no prescription or non-prescription medications. 
He reported no medical conditions. 


1.5.1.3 Flight Attendants 


According to records provided by ET, the cabin crew consisted of 5 female flight attendants. They were fully 
licensed in accordance with the provisions of the ECAA. 


1.5.1.4 IFSO 


The IFSO was seated in the front passenger's cabin amongst the passengers. He was counted for the load- 
sheet as a passenger and listed on the passengers manifest under a coded name. However, he was listed on 
the Crew General Declaration (CGD) and his official status on board was "extra-crew". The IFSO was licensed 
in accordance with the provisions of the ECAA national regulations after completing the appropriate AVSEC 
courses and was authorized to fly on board Ethiopian Airplane in the capacity of IFSO sitting with the 
regular passengers. 


1.6 AIRPLANE INFORMATION 
1.6.1 General 


The B737-8 (MAX) is a low wing, narrow body single aisle, jet transport with a conventional tail unit 
configuration, powered by two bypass turbofan CFM Leap-1B engines mounted on pylons beneath the 
wings. The Airplane is manufactured by Boeing Commercial Airplane and is the fourth generation of the 737 
series. According to the Boeing Company's website, the Airplane was designed to carry 162-178 passengers, 
depending on seating configuration. The 737-8 MAX took its maiden flight on January 29, 2016, and was 
type certificated with the FAA on March 8, 2017. 

ЕТ-АУ) was a В737-8 MAX single aisle transport Airplane configured іп а 160 passenger multi-class 
arrangement manufactured by the Boeing Company and delivered to Ethiopian Airlines on 15 November, 
2018. The Airplane was powered by two LEAP-1B Turbo Fan Engines manufactured by CFM International. 
The Airplane had 1,330.3 hours with a total of 382 cycles at the time of the accident. 
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TABLE 6: AIRPLANE INFORMATION 


Airplane Type: Fixed Wing Multi-Engine 

Model: 737-8 (MAX) 

Registration Number ЕТ-АУ) 

Airplane Serial Number 62450 

Airplane Manufacturer Boeing Commercial Airplane 

Airplane Category: Transport 

Seating arrangement: Multi-Class 

PAX Seating Capacity: 160 

MAX. T/O Weight: 82,190 kg 

Total Time: 1330.3 hours 

Total Cycles: 382 

Engine Type: Turbo Fan 

Number of Engines: 2 

Engine Manufacturer: CFM International 

Engine Model: LEAP-1B28B1G05 

Manufactured Year: 2018 

Airplane Owner Ethiopian Leasing (5-737) LTD 

Address: C/O WALKERS CORPORATE LIMITED, 
CAYMAN CORPORATE CENTER, 27 
HOSPITAL ROAD, GEORGE TOWN, 
GRAND CAYMAN КҮ1-9008, CAYMAN 
ISLANDS 

Airplane Operator Ethiopian Airlines Group 

Address: Bole International Airport P.O. Box 
1755 Addis Ababa, Ethiopia 
Operator Certificate Number: CATO- 
01/270295 


1.6.2 Airplane Flight and Maintenance Log 


The Maintenance Log Book (MLB) was reviewed in detail for the last 39 flights from 26 February 2019 until 
09 March 2019 (previous flight to the accident flight). In addition, the records were reviewed for the 1A 
check conducted in early February. 
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Over the previous 39 flights, the MLB cited in particular: Captain's flight compartment PC power outlet has 
no power; the crew oxygen cylinder was replaced due to low pressure; and the APU would not start. АП 
three issues led to maintenance actions and did not reoccur. 


In addition, the MLB was reviewed at a higher level for all flights back to the delivery flight in November 
2018. Maintenance actions of relevance occurred in early December 2018 and involved several write-ups 
involving temporary fluctuations of vertical speed and altitude as well as a report of the Airplane rolling 
during autopilot operation and altitude and vertical speed indication on the PFD showed an erratic and 
exaggerated fluctuation indication. Maintenance actions were performed and none were reported to have 
recurred. However, the erratic and intermittent nature of the fluctuations made it difficult to insure a 
permanent solution of these parameters. 


The ET302 airplane experienced flight control system and miscellaneous electrical faults prior to the 
accident flight. 


a. Flight control problems started occurring on the ET302 airplane on Dec 3, 2018, eighteen days after 
delivery. Pilot write ups included temporary fluctuations of vertical speed and altitude as well as a 
report of the aircraft rolling during autopilot operation and altitude and vertical speed indication on 
the PFD showed an erratic and exaggerated indication; 

b. Three days before the accident the Auxiliary Power Unit (APU) Fault Light illuminated, and the APU 
had a protective shutdown; 

c. The onboard maintenance function computer message also indicated the Start Converter Unit (SCU) 
showed the APU's start system was inoperative; 

d. The Captain's personal computer power outlet had no power; 

e. None of these pre-accident problems can be explained by a bird strike. 


According to the Ethiopian Civil Aviation Authority (Document number ECAA/AWS/OF/025, Ethiopian 
Airlines (the ‘operator’) is authorized to conduct maintenance on various Airplane'spercertificate number 
002/88. The Op. Spec issued to the operator states that operations shall be conducted in accordance with 
the Ethiopian Civil Aviation Authority Rules and Standards (ECARAS), part 6. 
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Authorized Maintenance Program: Certificate number 002/88 authorizes the following airframe 


maintenance: 
TABLE 7: OPERATOR MAINT. PROGRAM 

Manufacturer | Make/Model Capability Limitations 

Boeing B737- Line and Base No limitation 
300/400/500/600/7 | Maintenance 
00/800/900 

Boeing B737MAX Line and Base Limited up to and including 

Maintenance 1'A' checks 
Boeing B757/767 Line and Base No limitation 
Maintenance 
Boeing B777-200/300 Line and BaseMaintenance | No limitation 
Boeing B787-8/-9 Line and BaseMaintenance | Limited up to and 
including all '2C' checks 
Airbus A350 XWB-900 Line and BaseMaintenance | Limited up to and including 
all “1C” checks 

Bombardier DHC-8-400 & DHC-8- | Line and BaseMaintenance | No limitation 
100/200/300 

Fokker F27MK050 Line and BaseMaintenance | No limitation 

Diamond DA40NG Line and BaseMaintenance | No limitation 

Diamond DA42NG Line and BaseMaintenance | No limitation 

De Havilland DHC-6 Line and BaseMaintenance | No limitation 


1'A' Check: 


Per the maintenance limitations noted above, a 1'A' check was conducted on the accident Airplane 
between 01 February and 04 February, 2019.This check primarily concentrates on routine inspection for 


airworthiness (General Visual Inspection - GVI) as well as check and replacement of lubrication. 


Airworthiness Directives (AD) 


The Ethiopian Airlines provided an AD compliance report for review by the EAIB. This included 


airworthiness directives being tracked for the airframe, the two installed engines and appliances. 
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The AD summary report included the limits, intervals, and current status (as applicable). A review of the 
Airworthiness Directive status report for the Airplane, power plants and appliances was conducted. All 
applicable AD's had been incorporated during Airplane production. No AD's affected the two installed 
engines or APU. 


There was one AD service bulletin listed as open; this involves the prevention of fires in the lavatories 
from burning paper, etc. This is an inspection bulletin with an interval of flight hours of 940. The next 
inspection was scheduled at 1940 flight hours. 


One of the entries in the AD compliance report was AD-2018-23-51, Titled "To Address this potential 
resulting nose down trim". This emergency AD was prompted by analysis performed by the manufacturer 
showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight 
control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer. 
This condition, if not addressed, could cause the flight crew to have difficulty controlling the Airplane, and 
lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain.The 
compliance report indicates that compliance was through AFM revision on 11.08.2018. 


Service Bulletin (SB) Summary: 


A review of the service bulletin list includes the installation of engine Electronic Engine Control (EEC) 
control software version 6.5 (07 January, 2019) as well as the installation of new shoulder bearings and a 
hinged loop clamp on a fuel tube located on the engine. The installation is intended to improve reliability 
of the clamp. 


1.6.3 Maintenance History 


The Airplane maintenance history containing daily flight and maintenance information was reviewed from 
the date range of November 15, 2018 (delivery date) through March 10, 2019 (accident flight). 


Maintenance Record Logbook 


On March 15, 2019, the Maintenance Group performed a review and documented Ethiopian Airlines daily 
maintenance record logbook pages 518301 to 502140 for Airplane ET-AVJ. Additionally, all the daily 
technical logs that extend back to the delivery flight (Nov 15, 2018) were reviewed. Special emphasis was 
put on any log entry pertaining to abnormal indication or Airplane behavior. 
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TABLE: 8 ALL DAILY TECHNICAL LOGS 
Log Ref Date DEP ARR | Write ups Rectify Action Other work 
performed 
502140 10Mar, 19 | JNB ADD None None 
502139 9Mar, 19 ADD JNB Installed 3 each LG Removed 3each LG down 
Down lock pins lock pins 
502138 9Mar, 19 JNB ADD None None 
502137 8Mar, 19 ADD JNB 1.Installed3 each LG i. Removed 3 each LG 
down lock pins down lock pins Engine diagnosis 
2. APU fault Light is | 2. (ref IFIM 49-61-00-700- data downloaded 
1. 
clear add remark OMF, fund msg #1 (49- 
41254). Replaced the SCU 
and APU success fully 
started with APU limited 
restart 
502136 8-Mar-19 | PAR ADD | APU Fault Light ison | Transferred to ADD page 
(APU is INOP) (501137) 
502135 8-Mar-19 | NA NA Green sheet - parked | Green sheet - parked per 
per above above 
502134 7-Mar-19 | JNB ADD | None None 
502133 7-Mar-19 ADD JNB APU Fault Light is Rev# 201902150301 15 
on, АРУ had а | Jan 2019 -OMF Bite shows 
protective shutdown | mnt msg 49-41254 (start 
converter unit shows start 
system in op); Re-racked 
unit and APU started with 
APU limited restart 
function as per IFIM 49-40- 
00- 810-818 
502132 7-Mar-19 | TLV ADD | None None 
502131 6-Mar-19 | ADD TLV АП landing gear | Removed 3 each landing Gaspath cleaning 
down lock pins | gear down lock pins of engines 
installed 
502130 5-Mar-19 | NBO ADD | Installed all gear | Removed all three landing 
pins gear pins 
502129 5-Mar-19 | ADD NBO Downloaded 
engine diagnostic 
data 
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502128 5-Mar-19 | TLV ADD |None None 
502127 4-Mar-19 | ADD TLV Installed gear pins Removed gear pins 
502126 4-Mar-19 | ABV ADD |Crew 02 cylinder Replaced crew 02 cylinder 
pressure is below 
1000 psi 
502125 4-Mar-19 | ADD ABV | None None Downloading 
engine 
diagnostic data 
&recording APU 
EGT 
518324 3-Mar-19 | TLV ADD | None None 
518323 ADD TLV None None 
518322 3-Mar-19 JNB ADD None None 
518321 2-Mar-19 | ADD JNB 3 each pins installed | Removed all 3 each landing Visual check of 
gear down lock pins scheduled 
518320 2-Mar-19 | EBB ADD | Auto land Noted 
accomplished 
successfully at EBB 
518319 2-Mar-19 | ADD EBB None None 
518317 2-Mar-19 | JNB ADD | None None 
518316 1-Mar-19 | ADD JNB Flight Compartment | Performed Captain PC Inspection of 
PC Power Outlet Has | Outlet Initial Evaluation TGB 
No Power (Captain) | and Found Captain PC scavenge screens 
Outlet Has No Power 
518315 1-Mar-19 | WHD ADD | None None 
518314 1-Mar-19 | ADD WHD | None None 
518313 N/A N/A N/A | Pc power outlet no Deferred to ADD 
power, Captain's 
(pre flight) 
Daily check | Noted and daily check 
518312 28-Feb-19 | JNB ADD | performed in JNB | performed as per BTC 32- 
without specific task | 270-01102-01 
card / no MX data 
made either. Check 
if needs to be 
performed for a 
legal dispatch 
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Check both nose | Balanced tire pressure and 
wheels for proper | inspect both tires for wear, 
inflation. During | aj landing gear 
ground roll vib components, also shock 
"DE ees With | struts all found normal as 
wheel spin up ----- per IFIM 32-1-00 809 810. 
Ktocking of gear! Rev# 201902150301 is 
ЗИРК Feb 2019 
518311 28-Feb- | N/A Installed 3 each | Removed 3 each landing | TCB inspection 
4 : task performed 
19 landing gear down | gear down lock pins, 
lock pins. 
Daily check expired | performed daily check at 
at 18092 and now at | 20:28 on 28-02-2019 (not 
19582 logged in the MX system) 
518310 27-Feb-19 | WHD | ADD | None None 
518309 27-Feb-19 | ADD WHD | None None None 
518308 26 Feb19 | TLV ADD | None None None 
518307 26- ADD TLV None NAVdata 
Feb19 None update, engine 
diagnostic data 
Download,down 
loading engine 
diagnostic data 
518306 26-Feb-19 | TLV ADD | None None 
518305 25-Feb-19 | ADD TLV Installed gear pins All three landing gears are | Performed OP 
removed checked of SPCU 
518304 25-Feb-19 | NBO | ADD | None None 
518303 25-Feb-19 | ADD | NBO | None None 
518302 25Feb19 | МВО |ADD | None None 
518301 25-Feb-19 | ADD NBO | None None 
Log Ref | Date DEP ARR | Write ups Rectify Action 
24640  10Dec-18 | LAD ADD | Capt. Side altimeter BITE on OMF shows no related fault. GVI 


indication erratically 
showed a descent and a 
lower level and back to 
normal indication at FL 380 


performed for static ports, no damage found; no 
FOD found BITE done on FMC for ADIRU falts, 
found none. OPC performed as per AMM 
34-21-00-710-806; test passed 
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vertical speed indicator on 
both PFD's showed 
anerratic and exaggerated 
indications (movigp and 
down very rapidly) for 
about 2 sec. and then 
returned to back normal 


24628  7Dec-18 LAO ADD | During approach @1000' BITE done of FMCCDU (DFCS); no fault found as 
AGL the A/C starts rollingto | per 22-11-34-040-80. Performed land verify test 
the righ twith the auto pilot | as per AMM22-11-00-700-801; found normal 
engaged. 

23645 Ибес-18 | DOH | ADD | During approach at8600 — | IFIM 34-31-00-810-819- No existing fault found 
feet, altimeters rapidly on OMF. Fault history found on OMF is that MMR 
descend and returned to is not giving valued input From ОМЕ, as per them 
normal causing auto pilotto | annual MMR operational test Preformed test- 
revert to CWS"P", L-NAV passed. Per AMM34-37-00-710-801, ranop test; 
remained engaged. passed 

23639 |3-Пес-18 | DAR ADD | After take-off, altitude and AMM46-13-02-710-8010MF shows no fault in 


bound FDEF fault has no fault history and also 
has no related fault. FMC operational test 
performed as per AMM34-61-00- 

710-801 and tests how no fault. 


The only scheduled check of the Airplane occurred from 01 February and 04 February 2019. This is a 


routine check and General Visual Inspection (GVI) of various areas of the airframe. 


discrepancies or repairs were noted for this check. 


1.6.4 Engines 


No major 


The accident engines were СЕМ LEAP-1B28B1, a high bypass, dual rotor, axial flow turbofans. The engine 
consists of 3 major assemblies: low pressure compressor (LPC), core engine, and low-pressure turbine 
(LPT). The core engine consists of a two-stage high pressure turbine (HPT) which drives the ten-stage high 
pressure compressor (HPC). The four-stage integrated fan and low-pressure compressor (booster) is driven 
by a five-stage LPT. The annular designed combustion chamber increases the HPC discharge air velocity to 
drive the high- and low-pressure turbines. An accessory drive system provides drive requirements for 


engine mounted Airplane accessories and is driven by the high-pressure module. The accessory drive 


system includes two sub-modules which can be removed or installed at engine level, the accessory gearbox 
(AGB) and the transfer gearbox (TGB). 
The engine control system supplies manual and automatic control inputs to operate the engine.The engine 
control system has these components: 


е Thrust levers (forward and reverse) 


e Thrust lever resolvers 


* Engine start levers 


e Thrust lever interlock solenoids 
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FIGURE: 6 - CFM LEAP 1B - CROSS SECTION 
1.6.4.1 Engine History 


According to the engine's FAA Type Certificate Data Sheet (TCDS) E00088EN, Revision 4, dated November 
30, 2018, the engine has a Maximum takeoff thrust rating of 29,317 pounds flat-rated! to 86?F (30?C) and a 
Maximum continuous thrust rating of 28,690 pounds flat-rated to 77?F (25?C). 


TABLE 9: ENGINE INFORMATION 


Engine Serial Number (602722 (L/H) 602695 (R/H) 
Last Install Date October 2018 October 2018 
Last Shop Visit N/A N/A 

Cycles SinceInstall 382 382 

Cycles Since New 382 382 

Cycles Since Shop Visit |N/A N/A 

Time Since Install 1330 hours 1330 hours 
Time Since New 1330 hours 1330 hours 
Time Since Shop Visit |N/A N/A 
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The engines were designed and built by CFMI, a joint venture between General ElectricAviation (GE) of the 
USA and Safran Airplane Engines (SAE) (formerly Snecma (Société Nationale d'Etude et de Construction de 
Moteurs d'Aviation) Moteurs of France). The division of labor is such that Safran is responsible for the Fan 
and LPT modules while GE is responsible for the remainder of the engine - HPC, Combustor, and HPT. 


1.6.4.2 Maintenance Records & Reports 


According to CFM record, both engines were compliant with the following service bulletins: SB 72-0222 - 
Inspect TGB scavenge screens (Feb 22, 2019) 


SB73-0014 - PSS Blow Out and vacuum proc. (Jan. 16, 2019) 


SB 73-0016 - New EEC software Version 6.5 (Jan. 8, 2019) 


CFM also reported that no monitoring alerts, customer notification reports (CNR), or abnormal records were 
reported on these engines since entry into service (EIS). Additionally, no recent maintenance tasks were 
declared on either engine. The engine sends electronic 'snapshots' to CFM at engine start and after takeoff 
and no anomalies were noted during the previous flights. 


The exhaust gas temperature (EGT) margin was routinely monitored on the Airplane and electronically 
transmitted to CFM for maintenance surveillance. A review of these records revealed an EGT margin on both 
engines at the time of the accident was greater than 80°C. 

СЕМ has reviewed snapshot reports from ET-AV] over the last four flights - three on March 9th and the 
event flight on March 10th. These reports were reviewed for engine parameter content with no unexpected 
or unusual engine conditions identified. All parameters were within expected values for the respective 
phase of flight with no engine faults detected. 

According to the Ethiopian logbooks, only two procedures had been accomplished in the last 30 days: a 
water wash and an Engine Data Diagnosis Download. 


Examination of the Engines 
Identification of Installed Location ofEngines 


Because the serial number plates were not found, the handedness of the engines was not readily identifiable, 
so the serial numbers of some internal components were used to make this determination. The serial 
numbers were compared to the CFM build records to confirm the engine serial number and therefore 
Airplane location. See (Table 9&10). 
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TABLE 10: RIGHT HAND ENGINE PART IDENTIFICATION S/NS 


December 2022 


ESN 602722 (Installed Left Position) 


Designation Part Number Serial Number* | Recovered |S/N Identified Note 

Fan Disk Not Recovered 
364-040-010-0 |HB150486 

LPC Stage 2-4 Spool Not Recovered 
364-905-100-0 |МА510264 

HPC Stage 1 Blisk X Remained with core 
2639M71G02 |GWN13E24 

HPC Stage 2 Blisk X Remained with core 
2552M02P02 !GLHWOCAO 

HPC Stage 3-4 Blisk X Remained with core 

Spool 2552M03G02 |GLHWOA6N 

HPC Stage 5 Blisk X Remained with core 
2552M05P02 |ТМТ138М0 

HPC Stage 6-10 Spool X Remained with core 
2552M06G04 |СУ/М1ЗЕМ) 

HPT Rotor Disk Stage 1| 2600M21G02 (GWN13ECE x nee wath tope, Rit 

recovered 

HPT Rotor Disk Stage 2 X Remained with core 
2547M01G02 |ТМТ130СК 

LPT Rotor Disk Stage 1 X X Separated from engine 
364-021-030-0 |PC740173 core 

LPT Rotor Disk Stage 2 X X Separated from engine 
364-021-130-0 |PC738557 core 

LPT Rotor Disk Stage 3 X X Separated from engine 
364-021-230-0 |PC738549 core 

LPT Stage 4, Disk X X Separated from engine 

STBSHF 364-001-611-0 |HC278966 core 

Foundwithstage5rotatinga 
LPT Rotor Disk Stage 5 | 364-600-011-0 |GA005072 X irsealattachedP /N364-062- 


010-0,5/N DY168293 
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December 2022 


Left Hand Engine Part Identification S/No 


ESN 602695 (Installed Right Position) 


*Serial Number based on CFMI Delivery Records 


1.6.5 AIRPLANE SYSTEMS DESCRIPTION 


Designation Part Number Serial Recov S/N Note 
Number* | ered | Identified 

Fan Disk 364-040-010-0 | HB150564 X X Separated from engine core 

LPC Stage 2-4 Spool 364-905-100-0 | МА510373 Not Recovered 

HPC Stage 1 Blisk 2639M71G02 | TMT146AG | x Separatedfromenginecore(stage 
1-3 recovered together) 

HPC Stage 2 Blisk 2552M02P02 | GLHW0A66| x Separatedfromenginecore(stage 
1-3 recovered together) 

HPC Stage 3-4 Blisk 2552M03G02 | GLHW0A67| x Stage S тесбуегеп with Stage 1-2. 

Spool Stage 4 not recovered. 

HPC Stage 5 Blisk 2552М05Р02 | GLHWOCKH X Separated from engine core. 
Spoolseparatedfromengine.Stage 
7hub/webseparatedfromengine, 

HPC Stage 6-10 Spool 2552M06G03 | GWN13EAH X rimnotrecovered.Otherstagesnotrecovered. 
Separated from engine core. Rim section liberated and 

HPT Rotor Disk Stage 1 | 2600M21G02 | GWN13EEE X found 
Protruding from HPT Case. 

HPT Rotor Disk Stage 2 | 2547M01G02 | TMT1469H X Remained with engine core 

LPT Rotor Disk Stage 1 | 364-021-030-0 | PC735264 X Remained with engine core 

LPT Rotor Disk Stage 2 | 364-021-130-0 | РС681407 X Remained with engine core 

LPT Rotor DiskStage 3 | 364-021-230-0 | DY386829 X Remained with engine core 

LPT Stage 4, Disk 364-001-611-0 | PC640864 X Remained with engine core 

STBSHF 

LPT Rotor Disk Stage 5 |364-600-011-0 (6A004847 к Separated from engine core. Found with stage 5 rotating air 


seal attachedP/N364-062-010-0,5/NHB301273 


The systems described in this document are the systems on the airplane at the time of the accident. 


1.6.5.1 AOA over View 


The angle of attack (АОА) system senses angle of airflow between a reference line on the Airplane and the 
wind direction. 


Angle of Attack (AOA) Sensors 


The Boeing 737-МАХ8 has two independent angle-of-attack (AOA) sensors, one on each side of the forward 
fuselage. The AOA sensors consist of an external vane which rotates to align with the local airflow connected 
to two internal resolvers which independently measure the rotation angle. 
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A wedge vane is mounted external to the Airplane to accurately sense local airflow angle. Embedded heater 
in a vane thermally compensates to increase vane surface temperature in high flow and icing. It is coupled to 
electrical transducers via mechanical shaft. The vane is mechanically balanced with an internal 
counterweight. 


FIGURE7: AOA SENSOR  FIGURE8: AOA LOCATION ON A BOEING 737 
The AOA sensor used on the Boeing 737-МАХ8 is made by Collins Aerospace. 


For each AOA sensor (left and right), one resolver is connected to the respective Stall Management Yaw 
Damper (SMYD) computer and the second resolver is connected the respective ADIRU. Both the SMYD and 
ADIRU monitor the resolver circuits within the AOA sensor. If a fault is detected, the AOA resolver 
information is not used and the fault is annunciated. 


There is no scheduled maintenance for AOA sensors. Any required maintenance is a consequence of 
annunciated faults or observed malfunctions. This practice is “on-condition” maintenance. 


1.6.5.2 Use of AOA Values 


The AOA values directly used by the ADIRU to compute static source error correction, which affects all 
computations involving static pressure such as: 


e Mach corrected values 

e CAS corrected values 

e Altitude corrected values 
e Bythe SMYDC 
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o tomanage the Stall warning activation 
o tocompute the loop gain ofthe yaw damping system 
o tocompute stick shaker speed 
o tocompute operational speeds 
o tocompute the Pitch Limit Indicator (PLI) 
- By the FCC 
o To trigger MCAS activation 
о To compute MCAS duration 


Erroneous AOA values would also impact the following systems (non-exhaustive list) 


- ADIRU, for the computation of TAS, Baro corrected altitude,...etc 
- F/D and autopilot: with invalid CAS, Baro altitude,...etc 
- FMC through baro altitude values, with potential impact on the auto throttle commands. 


1.6.5.3 AOA Vane and Anti-Ice Protection 


AOA vane heating belongs to the anti-ice protection. In case of a fault of the vane heating, the following 
systems activate: 


- the master caution triggers (master caution light illuminates) 
- the ANTI-ICE light (right system annunciator) illuminates 
- Тһе [L/R] ALPHA VANE message illuminates (on the Probe heat panel of overhead panel). 


The vane heating monitoring is based on current detection circuit. After the current drops, there is a delay 
of 3 to 5 s before the light "[L/R] Alpha Vane" illuminates and the master caution triggers. In other words, 
the airplane suffered a loss of power to the left AOA Sensor Heater. 
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The ADIRU performed a limited monitoring of the AOA sensor, based on the signal received from the 
resolver. The ADIRU generates "AOA signal failed" information if it detects one or more of the following 


conditions: 


- theresolver output is zero volts 
- thecombined amplitude is outside the acceptable range 


- The calculated AOA vane shaft angle is outside the range defined by the mechanical stops. 
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The ADIRU generates "AOA failed" information when it detects any of the above conditions or if the 
reference (excitation) voltage signal provided to the AOA sensor from the Airplane 28VAC power bus is out 
of range. 


Impact ofAOA Failure on ADIRU 


One input of the ADIRU is of AOA vane heating failure. In this case, ADIRU goes on providing its parameters 
without any information of failure. ADIRU only records a failure code inside its BITE memory. 


If the ADIRU detects any failure through its AOA monitoring the ADIRU provides its output data with 
invalidity information (NCD - No Computed Data or FW - Failure warning). In this case, the systems 
receiving these data do not use them; in particular, the Display Processing Computer (DPC), sets up flag on 
the PFD: 


- SPD flag appears on the PFD and speed tape is no more displayed 


- ALT flag appears on the PFD and altitude tape is no more displayed. 


Effects of Erroneous Angle of Attack 


The effects of erroneous Angle of Attack (AOA) that is not declared invalid vary depending on the magnitude 
and direction of the error. 


Flight Deck Effects: 
e Display of erroneous airspeed and barometric corrected altitude on one Primary Flight Display (PFD) 
e Potentially erroneous stick shaker functions on one side and incorrect lower barber pole, lower 
amber band, and Pitch Limit Indicator on one PFD 
e Possible autopilot disconnect warning for disconnect conditions (light and aural), NO AUTOLAND 
recall in fail-op auto land configuration (displayed on the engine format). 
e If the displays software option for AOA Indication is displayed, erroneous AOA information on one 
PED is displayed 
e The following are displayed on both PFDs if display system thresholds are tripped: 
- JAS DISAGREE 
= When captain’s and first officer's airspeed indications disagree by 5+Kt for 5 continuous 
seconds 
- ALT DISAGREE 
= When captain's and first officer’s barometric altitude disagree by 200+ feet for 5 


continuous seconds 
51 


Aircraft Accident Investigation Report B737- МАХ 8, ET-AVJ December 2022 


- AOA DISAGREE 
= When the left and right AOA signals from the Air Data Inertial Reference Unit (ADIRU) 
disagree by 10+ degrees for 10 continuous seconds 
е If EFS command is longer than 30-45 seconds, the FEEL DIFF PRESS light will illuminate 
е Possible indications of a Predictive Wind Shear (PWS) event in regions where those indications 
would be otherwise inhibited ("WINDSHEAR" text on the ND/PFD, PWS Audio messages). 


AOA DISPLAY OPTION 


Boeing provides the option for the operator to install the AOA indicator on the PFD for Boeing 737-8 (MAX). 
The respective PFD will show the AOA information as shown in the figure-11 below. 


FIGURE 11: AOA indicator on 


AOA Disagree Alert 


As shown in (figure 12) the “АОА DISAGREE" message appears on the Captain and First Officer PFD when 
the values of the left and right AOA transmitted by the ADIRUS differ by 10? or more for 10 continuous 
seconds. The annunciation is only displayed in the air because AOA values are unreliable when the 
Airplane is stationary on the ground. 

The AOA DISAGREE message was first implemented on the Boeing 737NG fleet in 2006 in response to 
customer requests. Since 2006, the AOA DISAGREE alert has been installed on all newly manufactured 
Boeing 737 NG Airplanes, and is available as a retrofit for older Airplanes. 


The AOA DISAGREE alert has not been considered as a safety feature by Boeing, and is not necessary to 
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safely operate the Airplane. Airspeed, attitude, altitude, vertical speed, heading and engine thrust settings 
are the primary parameters the flight crews use to safely operate the Airplane in normal flight. Stick 
shaker 


AOA Disagree Alert (amber) 


Figure 12: AOA Disagree message on the PFD 


and the pitch limit indicator are the primary features used for the operation of the Airplane at elevated 
angles of attack. The AOA DISAGREE alert provides supplemental information only. 


At the time of the accident, the AOA DISAGREE non-normal procedure??alerted pilots to the possibility of 
airspeed and altitude errors, and of the IAS DISAGREE and ALT DISAGREE alerts occurring, but did not 
include any flight crew action in response to the AOA DISAGREE ALERT!!, The requirements for the AOA 
DISAGREE alert were carried over from the Boeing 737NG to the Boeing 737-8 (MAX). In 2017, however, 
within several months after beginning Boeing 737- 8 (MAX) deliveries, Boeing identified that the Boeing 


10The AOA DISAGREE non-normal procedure was revised to direct flight crew to the Airspeed Unreliable NNC as part of the Return to 
Service activities conducted prior to the resumption of commercial 737 MAX flights in 2020. 
DISAGREE alert! 
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737-8 (MAX) display system software did not correctly implement the AOA DISAGREE alert 
requirements. As with the Boeing 737 NG, the Boeing display system requirements for the Boeing 737-8 
(MAX) called for the activation of the AOA DISAGREE alert as a standard feature on all Airplanes. The 
software delivered to Boeing, however, linked the AOA DISAGREE alert to the AOA position indicator, 
which is an optional feature on the Boeing 737 (MAX) series. Accordingly, the software activated the AOA 
DISAGREE alert only if an airline opted for the AOA indicator. At the time of the accident, Boeing advised 
that the AOA indicator hadbeen selected by approximately 2096 of airlines. 


When the discrepancy between the AOA display requirements and the software was identified, Boeing 
determined that the absence of the AOA DISAGREE alert did not adversely impact Airplane safety, 
certification or operation. Accordingly, Boeing concluded that the existing functionality was acceptable 
until the originally intended functionality could be implemented in a display system software upgrade 
scheduled for the third quarter of2020. 


Ethiopian Airlines did not select the optional AOA indicator feature on the PFD of their 737-MAX8 
Airplane; thereforeas a result, the AOA DISAGREE did not appear on ET-AV] Airplane, even though the 
necessary conditions were met. 


1.6.5.4 Air Data System 


The Boeing 737 MAX 8 is equipped with an Air Data Inertial Reference System (ADIRS) that provides 
flight data to the flight deck display panels, flight management computers, flight controls, engine controls 
and all other systems requiring inertial and air data information. The ADIRS combines the Air Data 
System (ADS) function and the Inertial Reference System (IRS) function into a single device identified as 
an Air Data Inertial Reference Unit (ADIRU). The ADIRUSs provide inertial position and track data to the 
flight management system and provide attitude, altitude and air speed data to theflight deck displays. The 
ADIRUs process information measured by internal gyros and accelero meters and information from the 
air data sensors. 


Pitot and Static System 


The pitot static system is comprised of three separate pitot probes and six flush static ports; two of these 
pitot probes and four of the static ports interface with the Air Data Modules (ADM), which convert 
pneumatic pressure to electrical signals and send these data to the ADIRUs. The remaining auxiliary pitot 
probe and alternate static ports provide pitot and static pressure to the standby instruments. The 
auxiliary pitot probe is located on the first officer's side of the Airplane. 
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The ADM connected to the Captain's pitot probe sends information to the left ADIRU, while the ADM 
connected to the First Officer's pitot probe sends information to the right ADIRU. The remaining ADMs 
are located at the balance centers of the Captain's and First Officer's static ports. The ADM connected to 
the Captain's static ports sends information to the left ADIRU for display of the captain's instruments, 
while the ADM connected to the First Officer's static ports sends information to the right ADIRU for 
display on the first officer's instruments. 


AIRDATA REFERENCE (ADR) 


The Air Data Reference (ADR) function of the ADIRU is to sense the Airplane's pitot and static pressures 
external to the Airplane and convert them into digital electrical signals. These pressures, in conjunction 
with the Total Air Temperature (TAT) and the Airplane's AOA are used by the ADIRU to calculate basic air 
data information (parameters) for transmission to various systems on the Airplane. Some of the 
parameters that the ADIRU transmits include: altitude, computed airspeed, and true airspeed. Another 
function of the ADIRU is to provide AOA information (indicated angle of attack) directly to the Flight 
Control Computers as an input to the MCAS function. 


Both the altitude and airspeed use static pressure which includes calculations for a correction factor of 
the Static Source Error Correction (SSEC). This is compensation for pressure errors caused by the 
airframe's aerodynamic effects on the static port. The static ports have been located to minimize errors. 
Compensation for the remaining errors is provided by a correction algorithm composed of three factors: 
basic correction, thrust effect compensation and ground effects compensation. 


The ADR uses the following parameters as primary parameters: 
- The static pressure coming from the static ports 
- The total pressure coming from the pitot probes 


- The AOA values coming from the AOA vanes 
- The Total Air Temperature (TAT) parameters coming from the TAT probes 
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FIGURE13: Illustrated static and total air pressure system 


1.6.5.5 Enhanced Digital Flight Control System (EDFCS) 


The Boeing 737 MAX8 is equipped with an Enhanced Digital Flight Control System (EDFCS). The EDFCS 
system on the 737 MAX8 is the same as the 737NG with the following added functionality in the flight 
control computer (FCC) software: 

1. Maneuvering Characteristics Augmentation System (MCAS), 

2. Emergency Descent in Autopilot and Flight Director Level Change Mode, 

3. Spoiler Control Electronics Interface, 

4. Autopilot Roll Command Alerting System. 
The EDFCS provides integrated operation of the following major flight control functions: 


- Altitude Alert 

- Autopilot (including Autoland) 

- Flight Director 

- Speed Trim 

- Mach Trim 

- Maneuvering Characteristics Augmentation System (MCAS) 
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- FMC Interface & Mode Control 
-  Autothrottle Interface, N1 Limits, & Mode Commands and Mode control 


The EDFCS has a mode control panel (MCP), two FCC's, and actuator inputs to the flight control system. 
The MCP is the primary interface between the flight crew and the FCCs. The FCCs get inputs from several 
systems such as the Air Data Inertial Reference System (ADIRS) and the Flight Management Computer 
(FMC) and send commands to the aileron and elevator actuators. These actuators control the movement 
of the ailerons and elevators, which control the flight path of the Airplane whenthe autopilot is engaged. 
There are two autopilots, autopilot A from FCC A and autopilot B from FCC B. When you engage an 
autopilot from the MCP, the autopilot can control the Airplane attitude through these phases of flight: 
Climb, Cruise, Descent, Approach, Go-around and Flare. 
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FIGURE14: EDFCS GENERAL DESCRIPTION 


1.6.5.6 Autopilot 


The autopilot is engaged by selecting one of two autopilot push button engage switches located near the 
right edge of the MCP, between the Vertical Speed display window and the right hand Flight Director 
toggle switch. 


The control column force must be less than 5 165 and the control wheel force must be less than 3 Ibs for 
the autopilot to engage. If the forces exceed these values, then attempting to engage the autopilot results 
in an autopilot disconnect warning. 
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The normal autopilot disengagement mechanism is via the quick disconnect pushbutton switches on the 
captain's and first-officer's control wheels. An alternate disengage mechanism is provided by the 
disengage bar located on the bottom edge of the MCP just below the engage buttons. An amber strip is 
exposed when the bar is down to positively indicate activation of the disengage bar. Pressing a lighted 
engage pushbutton also disconnects the autopilot (except when dual engaged for failed operational 
autoland—in this case only the corresponding channel disconnects). 


Certain failures of the EDFCS or interfacing systems will cause the autopilot to automatically disconnect 
when the failure occurs. The autopilot may also automatically disconnect upon use of certain source 
select switches but can (sometimes) be reengaged. 


Upon autopilot disconnect, the autopilot disengage light on the Autoflight Status Annunciator will 
indicate disconnect by flashing red. The annunciator is located just above both the Captain's and First 
Officer's inboard displays. This will be accompanied by an aural warning. The pilot may reset the 
warnings by pressing the autopilot disengage switch on the wheel or the light on the Warn Annunciator. 
The warning will continue for 2 seconds regardless of how quickly the pilot might reset the warning. 


1.6.5.7 Flight Director 


Selecting a Flight Director toggle switch to the ON position activates the Flight Director. The left switch 
enables the Flight Director Command bars on the captain's primary flight display (PFD). The right switch 
enables them on the first officer's display. When a Flight Director is initially selected ON, the bars will be out 
of view and there will be no active mode. Subsequent use of the TOGA switch or an MCP mode selection will 
bring the bars into view. 


The Flight Director Master light located next to the switch indicates which baro correction is currently in- 
use by the autopilot/Flight Director for calculations such as Altitude Alert or Altitude Acquire. Under normal 
operations, the left FCC provides the Flight Director commands for the left display and the right FCC 
provides similar commands for the right display. The Flight Director Command bars are biased out of view 
in the event of a mode failure. Flight Director Selection is annunciated by a green "FD" on the primary EFIS 
display when the autopilot is not engaged. Flight Director Modes may be engaged and used alone or may be 
displayed in conjunction with autopilot operation. 
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1.6.5.8 AutoThrottle 


Overview 


The auto throttle (A/T) system provides automatic thrust control from the start to takeoff through climb, 
cruise, descent, approach and go-around or landing. The A/T system controls engine thrust in response to 
the mode selected by the flight crew through the EDFCS, Mode Control Panel (МСР), Flight Management 
Computer (FMC) and ADIRU. 


The speed information taken from the ADIRU is used to calculate throttle lever rate commands to set engine 
thrust during changing flight conditions. All the information is processed by FCC, which provides commands 
to the thrust lever servo motors controlling thrust lever movement. 


The auto throttle Arm switch is a magnetically held two-position switch, located on the left side of the MCP, 
between the IAS/MACH display window and the left Flight Director toggle switch. Arming the A/T is 
preparing thesystemto engage in the N1, MCP SPD, or FMC SPD mode. A green light near the auto throttle 
Arm switch is illuminated when the auto throttle Arm switch is in the ARM positionand “ARM” appears on 
the Flight Mode Annunciator (FMA) portion of the PFD.In the ARM state the auto throttle will accept mode 
requests from the autopilot or TOGA switch and engage the appropriate auto throttle mode. While on the 
ground, the FMC thrust reference must be takeoff mode for the auto throttle ARM switch to hold in the ARM 
position and arm the system. When in the ARM state, the flight crew can set thrust lever position manually 
and the auto throttle will not alter those flight crew inputs. 


Moving the auto throttle Arm switch to OFF or activating an auto throttle quick disengage switch (which 
causes the auto throttlearm switch to move to the OFF position) disconnects the auto throttle. There was an 
auto throttle quick disengage switch installed on the outside edge of each thrust lever. The A/T disengage 
light will illuminate when A/T is disengaged. In addition to the ARM state, there are fiveauto throttle modes: 
N1, Speed, Go-Around, Retard and Throttle Hold. For each flight phase, the flight crew can select the A/TN1 
or speed modes from the MCP or directed by the FMC. During take off, pushing TO/GA switch engages the 
A/T in N1mode and causes the engine thrust to increase to the take off (TO) N1. 
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TABLE11: AUTOTHROTTLE MODES 


Mode Function 


Speed Maintain a user-selected speed. Throttle will be controlled 
from idle up to the N1 thrust limit shown on the EICAS display 
as needed. Throttle movements occur at a slow throttle rate. 
N1 Maintains thrust at the full N1 limit. 

Go-Around Advances thrust sufficient for a reasonable climb. Further 


advances thrust to G/A limit if TOGA switch pressed a second 
time. 

Retard Retard throttles to idle during level change descents and flare. 
Throttle Hold Holds thrust lever position (autothrottle servomotors 
depowered) during takeoff when speed exceeds 80kts to 
protect against autothrottle erroneous retard failures. 
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FIGURE 15: A/T SYSTEM - GENERAL DESCRIPTION 


The FMC calculates thrust N1 limits and N1 targets for each flight phase. The data goes to the Display 
Processing Computers (DPC). The DPC shows the N1 limits on the engine display. The DPC send the N1 
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targets to the EECs which calculate equivalent TRA targets to send to the A/T to set thrust. The A/T uses the 
EEC TRA targets to set thrust during takeoff, climb, and MAX thrust go-around. 


The FMC also sends N1 targets directly to the A/T. During takeoff and MAX thrust go-around, the A/T uses 
EEC TRA targets and FMC N1 targets to set thrust.If certain air data parameters from left and right ADIRUs 
are sufficiently far apart to fail a reasonableness check, the FMC invalidates its N1 limit mode output. 


The A/T function converts the target N1 values from the FMC to an equivalent TRA target. The target N1 
rating is dependent on the FMC engaged mode. 


During takeoff, climb, and MAX thrust go-around, the FMC N1 targets are the same as the N1 limits. 


The A/T function in FCC A sends A/T discrete digital data to both FCCs. The FCCs use this data to determine 
the mode the A/T is in and to which modes it will allow a change. 


The FCCs send mode request discretes to the A/T to select A/T modes consistent with the active EDFCS 
mode. The A/T needs also a valid N1 target from the FMC to switch from the ARM mode into another mode. 


1.6.5.9 SMYDC 


AUTOSLATS 

The autoslat system is designed to enhance airplane stall characteristics at high angles of attack during 
takeoff or approach to landing. When the flaps 1 through 25 are selected, the leading edge slats are normally 
in the extended position. As the airplane approaches the stall angle with the slats in the extended position, 
the slats automatically begin driving to the full extended position prior to stick shaker activation. The slats 
return to the extended position from the full extended position when the angle of attack is sufficiently 
reduced below the stall critical attitude, when flaps are raised to up, or when computed airspeed exceeds 
230Kt. Autoslat operation is controlled by the SMYD computers using angle-of-attack to determine when the 
airplane is approaching stall; either SMYD can provide the autoslat function by itself. 


YAW DAMPER (YD) 


At low angle of attack, YD dampens sideslip induced lateral-directional motion and provides turn 
coordination. At high angle of attack, turn coordination is disabled, yaw damper does not suppress sideslip 
and has a reduced Dutch roll damping. 


The yaw damper system consists of a main and standby yaw damper. Both yaw dampers are controlled 
through Stall Management/Yaw Damper (SMYD) computers. The SMYD computers receive inputs from both 
ADIRUS, both control wheels and the YAW DAMPER switch. SMYDs provide yaw damper inputs to the main 
rudder Power Control Unit (PCU) or standby rudder PCU, as appropriate. 
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STALL WARNING 


Natural stall warning (buffet) usually occurs at a speed prior tostall. In some configurations the margin 
between stall and natural stall warning is less than desired.Therefore, an artificial stall warning device, 
astick shaker isused to provide the required warning. 


Each control column has an eccentric weight motor which can vibrate the column to alert the pilots before a 
stall develops.The system is armed in flight at all times.The systemis deactivated on the ground, exceptduring 
the ground test. Two independent, identical SMYD computers determine when stall warning isrequired 
based upon: 


- Alpha vaneangle of attackoutputs- Wing configurations 
- Air/ground - ADIRU outputs 

- SensingThrust- Anti-ice controls 

- FMC outputs 


The AOA sensor is connected to the SMYD and provides the measured angle of direction of air flow relative 
to the fuselage. If the AOA sensor detects an excessive angle of attack compared to the design characteristic 
of the737 MAX 8, the SMYD will activate the stick shaker to provide aural and tactile alert to the flight crew. 
Two SMYD computers provide output for stall warning to include stick shaker, Pitch Limit Indicator, and 
maneuver and operating air speed limits. The SMYD1 activates the Captain's stick shaker, and SMYD2 
activates the F/O stick shaker. Vibrations from either stick shaker can be felt in both columns through the 
mechanical column interconnect. 


SPEED LIMITS 


The speed limits computed by SMYD are described in the following table. 
TABLE12: SPEED LIMIT 


Recorded parameter Meaning/display impact 
Maximum Maneuver | HIGHSPDBUFFETSPDFDR Speed tape impact: bottom of the amber 
Speed/High Speed bar below VMO/MMO providing 1.3 G 
Buffet manoeuver capability 
Minimum Maneuver | FCMINOPERATINGSPDFDR Speed tape impact: top of the amber bar 
Speed above the minimum speed (black and red 
lower stripes) 
Minimum Speed STICKSHAKERSPEEDSMYDC1FDR Speed tape impact: top of the black and red 
STICKSHAKERSPEEDSMYDC2FDR lower stripes. 
Stick shaker speed. 
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Note: When flaps are up, the bottom of the amber bar indicates the Maximum maneuver speed. This airspeed 
provides 1.3 G maneuver capability to high speed buffet (or an alternative approved maneuver capability set in 
the FMC maintenance pages). 


1.6.5.10 Pitch Control System 


Pitch control for the Boeing737-MAX8 is provided by two elevators and a horizontal stabilizer, which are 
both moveable control surfaces located on the empennage. 


ELEVATOR SYSTEM 


The Boeing737-MAX8 elevator control system provides primary pitch control of the Airplane using two 
elevators that are hydraulically powered with manual reversion availablein the event of a loss of 
hydraulics.This control system is activated by fore and aft motion of the captain's and first officer's control 
columns, which are connected via a torque tube with a forward cable control quadrant mounted at each end. 
Elevator control cables are routed from the quadrants aft and attach to a pair of aft elevator control 
quadrants, which are mounted on the lower elevator input torque tube!2. This tube is mechanically 
connected, via linkages, to each of the two power control units (PCUs) input control arm assembly. When 
rotated, the lower torque tube input arm assembly provides a simultaneous command to each PCU to extend 
or retract. The two PCUs operate іп unison and are powered by separate hydraulic systems, the left unit 
from hydraulic system "A" pressure and the right unit from hydraulic system B pressure. The output rod of 
each PCU is connected to the upper torque tube, which is directly linked by pushrods to each elevator. 


ELEVATOR FEEL SYSTEM 


An elevator feel computer provides simulated aerodynamic forces on the control column based on total 
pressure (from two dedicated pitot probes mounted on the vertical stabilizer) and stabilizer position. Feel 
force is transmitted to the control columns by the elevatorfeel and centering unit.To operate the feel system 
the elevator feel computer uses either hydraulic system A or B pressure, whichever is higher. 


Stall identification is enhanced by the Elevator Feel Shift (EFS) module and the Speed Trim System (STS). 
The STS is a function within the Flight Control Computers which enhances speed stability characteristics. 
MCAS is a sub function of the speed trim system. The increased force gradient provided by the MCAS 


"The aft elevator controls are located in the empennage aft of the stabilizer rear spar. 
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function, combined with EFS, provides a means for pilots to identify impending stall, along with other cues 
such as stick shaker, buffet, elevated AOA, and other flight deck indications. 


During high AOA operations, the Stall Management/Yaw Damper (SMYD) reduces yaw damper commanded 
rudder movement. The EFS module increases hydraulic system pressure to the elevator feel and centering 
unit during a stall. This approximately doubles control column forces for a typical stall entry. The EFS 
module is armed whenever an inhibit condition is not present. Inhibit conditions are Airplane on the ground, 
radio altitude less than 100 feet, or autopilot engaged. However, if EFS is active when descending through 
100 feet RA, it remains active until AOA is reduced below approximately stickshaker threshold. There are no 
flight deck indications that the system is properly armed or activated. As airspeed decreases towards stall 
speed, the speed trim system trims the stabilizer nose down and enables MCAS above stickshaker AOA. With 
this trim schedule the pilot must pull more aft column to stall the Airplane. With the column aft, the amount 
of column force increase with the onset of the EFS module is more pronounced. 


HORIZONTAL STABILIZER 


As shown in Figure-16 the horizontal stabilizer controls the pitch trim of the Airplane; its leading edge can 
be moved to a maximum position of 4.7 degrees up and 12.4 degrees down by the rotation of a jackscrew, 
which is connected to the front spar fitting of the stabilizer via a ballnut. 


The horizontal stabilizer is positioned by a single electric trim motor controlled through either of the 
stabilizer trim switches located on the pilots' control wheels or autopilot trim. The Speed Trim System, 
including the Speed Trim function and the MCAS function, can also command the trim motor when the 
autopilot is off. The main electric and FCC automatic stabilizer trim functions each have two speed modes: 
High speed with flaps extended and low speed with flaps retracted.For both flaps extended and flaps 
retracted, the main electric trim rate is faster than the FCC automatic stabilizer trim rate. If the autopilot is 
engaged, actuating either pair of stabilizer trim switches automatically disengages the autopilot. The 
stabilizer trim wheels rotate whenever electric stabilizer trim is actuated. The stabilizer may also be 
positioned by manually rotating the stabilizer trim wheels. 
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LATERA 
AXIS 


FIGURE 16: HORIZONTAL STABILIZER MOVEMENT 


The total range of the Horizontal Stabilizer movementis 17.1degrees or(units) which are depicted on the 
scale on the stabilizer trim indicator located on the center pedestal in the cockpitas shownin Fig.17, 
when the stabilizer trim indicator is at the zero position, the Horizontal Stabilizer is at its full leading-edge 
up position (Airplane is trimmed full Airplane nose-down). 
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STABILIZER TRIM 
INDICATOR 


FIGURE 17: STABILIZER TRIM INDICATOR 


1.6.5.11 Operation with Autopilot Off 


Electric Trim Switch Control 


Stabilizer trim can be commanded by the flight crew by using electric trim switches located on the outboard 
side of the captain's and first officers control wheels. Each control wheel contains two switches (arm and 
control) mounted side by side; when activated, the arm switch closes a relay to provide the main electric 
trim arm signal(28V DC) to the stabilizer trim motor; while the control switch provides the directional 
control to the stabilizer trim motor. Both switches (arm and control) must be activated in an Airplane nose 
up or nose down direction in order for the stabilizer trim motor to rotate the stabilizer jackscrew to 
reposition the horizontal stabilizer. 
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"яту. 


FIGURE 18: TRIM SWITCHES ON THE LH YOKE 
Manual Trim Wheel Control 


Manual stabilizer control is accomplished through cables which allow the pilot to position the stabilizer by 
rotating the stabilizer trim wheels. Each trim wheel is equipped with a manually deployable handle (visible 
in Figure 19), though the wheel can also be moved by grasping the rim without deploying the handle. The 
stabilizer is held in position by two independent brake systems when there is no electric command present 
to move the stabilizer. Manual rotation of the trim wheels can be used to override the brake systems, 
autopilot, or main electric trim. The effort required to manually rotate the stabilizer trim wheels may be 
higher under certain flight conditions. If the stabilizer trim system is actively trimming, grasping the 
stabilizer trim wheel will stop stabilizer motion. Approximately15 rotations of the stabilizer trim wheel are 
required for each degree (unit) of stabilizer movement. 
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FIGURE 19: THE TRIM WHEEL, WITH THE HANDLE EXTENDED 


a) Speed Trim Function 


The 737 -300, 400 and 500 (737 Classic) as well as the -600/700/800/900 (737 NG) family of Airplanes 
incorporated a Speed Trim System to augment the basic Airplane's speed stability during certain low speed, 
high thrust flight conditions by moving the horizontal stabilizer during manual flight (autopilot not 
engaged). The STS was carried over to the 737-7/-8/-9 (737 MAX) family of Airplanes. Additionally, on 
737MAX Airplanes, the MCAS function was added to the STS to address the pitch characteristics described 
above 


The Speed Trim function, which is part of the Speed Trim System, is implemented as a control law within the 
flight control computer (ЕССІЗ), and commands incremental stabilizer trim through the automatic trim 
control system circuitry. There are two different stabilizer trim rates depending on the position of the 
flaps!^. A schedule determines the desired incremental stab deviation from the last trimmed position as а 
function of airspeed and flap position. 


1З The flight control computers (FCC) are part of the Enhanced Digital Flight Control System. 
14 When the flaps are down, the stabilizer rate is three times faster than when the flaps are up. 
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b) MCAS 

The MCAS is a function within the Speed Trim System and, when activated, moves the stabilizer during non- 
normal, flaps up, manual flight, high angle of attack maneuvers to provide a desirable increase in stick force 
gradient and improved static longitudinal pitch stability. Similar to the Speed Trim function, the MCAS 
function is also a flight control law!5 contained within each of the two FCCs. Only one FCC at a time is 
permitted to send Speed Trim System commands to the stabilizer trim motor. At Airplane power-up, the 
master FCC defaults to the left side FCC; and will then alternate between the left and right FCC by flight. 
Certain failures cause the master FCCto change in flight. The master FCC is not affected by the position of the 
Flight Director switches. The FCCs receive inputs from several systems including the Air Data Inertial 
Reference System (Fig. 20). Specific to the MCAS, the control law commands the stabilizer trim as a function 
of the following: air/ground signal, flap position, angle of attack, pitch rate, true airspeed and Mach. 


737 MAX MCAS "em. 
Е Control Stand Yoke Control Column 
Ov e rv ! ем/ Manual Stabilizer y n | 


Trim Wheel - Switch 
STABILIZER CABLE MOTION 


Stabilizer | 


Trim Motor a) a e? 


Location 


— Data Flow 


Flight Control 
Computer (FCC) 


I" Air Data Inertia 
М Reference Unit (ADIRU) — - - 
са = TOTAL PRESSURE 


Pitot Probe AOA Sensor (FO) 


AOA & 


MAGH VANE ANGLE 


FIGURE 20: DIAGRAM SHOWING THE COMPONENTS OF МСА$16 


15 MCAS is an open loop flight control law. 
16 Reference Boeing 737 MAX MCAS briefing, dated March 25, 2019. 
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The AOA and Mach inputs are provided to each FCC by the associated air data inertial reference unit 
(ADIRU). Each ADIRU receives AOA information from one of the two resolvers contained within the 
associated AOA sensor (i.e. the Left ADIRU uses left AOA vane and the Right ADIRU uses the right AOA vane). 
Information from the other resolver contained within the AOA sensor is provided to the Stall Management 
Yaw Damper Computer (SMYD), which is used, along with data from other sources, for the purpose of 
calculating and sending commands to the Stall Warning System (SWS). 


As originally delivered, the MCAS became active during manual (autopilot not engaged), flaps-up flight when 
the AOA value received by the master FCC exceeded a threshold based on Mach number. When activated, 
the MCAS provided a high rate automatic trim command to move the stabilizer towards Airplane Nose 
Down. The magnitude of the Airplane nose down command was based on the AOA and the Mach. After the 
non-normal maneuver that resulted in the high AOA, and once the AOA fell below a reset threshold, MCAS 
would move the stabilizer to approximately the original position and reset the system. At any time, the 
stabilizer inputs could be stopped or reversed by the pilots using their yoke-mounted electric stabilizer trim 
switches, and then the MCAS system will reset after a 5 second delay. 


The latter behavior is based on the assumption that flight crews use the trim switches to completely return 
the Airplane to neutral trim. In the FCC software version current at the time of the accident, if the original 
elevated AOA condition persists for more than five seconds following completion of a main electric trim 
input, the MCAS flight control law will command another stabilizer nose down trim input (with the 
magnitude based on the AOA and Mach sensed at that time). 


On all 737 models, column cutout switches interrupt stabilizer commands, either from the autoflight system 
(e.g. FCC) or the electric trim switches in a direction opposite to elevator command. On the 737NG and MAX, 
two column cutout switching modules, one for each control column, are actuated when the control columns 
are pushed or pulled away from zero (hands off) column position. When actuated, the column cutout 
switching modules interrupt the electrical signals to the stabilizer trim motor that are in opposition to the 
elevator command. 


The MCAS function requires the stabilizer to move nose down in opposition to the column commands when 
approaching high angles of attack. To accommodate MCAS, the column cutout function in the first officer's 
switching module was modified to inhibit the aft column cutout switch while MCAS is active, allowing 
Airplane nose-down stabilizer motion with Airplane nose-up column input. Once MCAS is no longer active, 
the normal column cutout function in the stabilizer nose down direction is reinstated. Although the column 


17 The SWS operates the control column stick shakers to alert the crew when the Aircraft is nearing an aerodynamic stall. 
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cutout function will not interrupt an MCAS input, any main electric trim input would immediately override 
any MCAS command and the stabilizer will move in the direction commanded by the flight crew. 


Operation with Autopilot On 


When the autopilot is engaged, the autopilot logic provides automatic trim up and trim down commands to 
the horizontal stabilizer to reduce the need for any sustained deflection of the elevator. Neither Speed Trim 
nor MCAS are active when the autopilot is engaged. 

When the autopilot is engaged, the FCC provides automatic trim up and trim down commands to the 
horizontal stabilizer and this moves the stabilizer to reduce the amount of trim held by the elevators. 


STABILIZER TRIM CUTOUT SWITCHES 

There are two stabilizer trim cutout switches located next to each other on the aisle stand just aft of the flap 
lever. They are identified as the STAB TRIM PRI (stabilizer trim primary) cutout switch and the STAB 
TRIMB/U (stabilizer trim back up) cutout switch. If either switch is positioned to CUTOUT, power is removed 
from the stabilizer trim motor and neither main electric trim nor automatic trim can move the stabilizer. 


1.6.5.12 PFDIndications 


The Display Processing Computer (DPC) in the MAX Display System processes the data displayed on the 
PFDs. The Boeing 737 MAX 8 has two DPCs. The DPC receives ARINC 429 digital data and analog discrete 
from various Airplane systems. The DPCs processes these data to be displayed on the Display Units (DU) 
located within the flight deck. Both DPCs receive data from both the left and right ADIRU and either DPC is 
capable of driving the captain's and first officer's displays. 
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FIGURE 21: MAX DISPLAY SYSTEM 


PFD flags 


In the event of certain system failures, the data provided to the Display Processing Computer (DPC) may 
become invalid, e.g. No Computed Data (NCD) or Failure Warning (FW).In response, DPC and the Primary 
Flight Display (PFD) will show a flag instead of the particular parameter (ALT, SPD, ATT, etc.) with amber 
color and the particular parameter will not be shown in the PFD.Fig. 22 provide an example of the speed and 
altitude (ALT) flags. 


72 


Aircraft Accident Investigation Report B737- MAX 8, ЕТ-АУ) December 2022 


FIGURE 22: INSTRUMENT SPD AND ALT FLAGS APPEAR ON PFD 


1.6.5.13 IAS and ALT Disagree 


Both DPCs compare each other's data and in the case that the data is not similar at certain values for a 
certain period of time, the corresponding disagree message will be displayed on both PFDs. 

1. IAS disagree (Indicated Airspeed disagree) message appears if the airspeed indications on both PFDs 
different by more than 5 Kt for more than 5 seconds. 


2. ALT disagree (altitude disagree) message appears if the altitude indication on both PFDs different by 
more than 200 feet for more than 5 seconds. 
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Airspeed Disagree Alert (amber) Altitude Disagree Alert (amber) 


FIGUREZ23: IAS AND ALT DISAGREE MESSAGES ON THE PFD 


MINIMUM MANEUVER SPEED AND MINIMUM SPEED 


The minimum maneuver speed is indicated by the top of the amber bar on the PFD when the Airplane is in 
flight. This airspeed provides: 
е The 1.3g maneuvers capability to stick shaker below approximately 20,000 feet. 


е The 1.3g maneuver capability to low speed buffet (or an alternative approved maneuver capability 
set in the FMC maintenance pages) above approximately 20,000 ft. 


The minimum speed is indicated by the red and black barber pole. The top of barber pole indicates the speed 
at which stick shaker occurs. 
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Minimum Maneuver Speed (amber) 


Minimum Speed (red and black) 


FIGURE24: Minimum Maneuver Speed and Minimum Speed Indications on the PFD 
MAXIMUM OPERATING SPEED 


The Maximum operating speed (Maximum Mach operating speed (MMO) or Maximum operating speed 
(VMO) is displayed by the red and black barber pole warning band and the Maximum maneuver speed is 
displayed by the amber bar on top of the speed tape indication on the PFD. The Maximum operating speed is 
shown in Figure 25 below. The bottom of the barber pole indicates the Maximum speed as limited by the 
lowest of the following: 

. Vmo/Mmo 

е Landing gear placard speed 

e Flap placard speed 


When an over-speed condition occurs, a clacker aural warning will be active. The warning clackers can be 
silenced only by reducing airspeed below Vmo/Mmo. 
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Maximum Operating Speed (red and black) 


FIGURE 25: MAXIMUM OPERATING SPEED 


1.6.5.14 Alerts and Warnings 


GPWS Mode 3 A 


Mode 3 provides alerts for significant altitude loss after takeoff or low altitude go-around with gear or flaps 
not in the landing configuration. The amount of altitude loss that is permitted before an alert is given is a 
function of the height of the airplane above the terrain as shown below. This protection is available until the 
EGPWS determines that the Airplane has gained sufficient altitude that it is no longer in the takeoff phase of 
flight. Significant altitude loss after takeoff or during a low altitude go-around activates the EGPWS caution 
lights and the aural messages "DON'T SINK, DON'T SINK”. 

The aural message is enunciated twice for each 2096 degradation in altitude. Upon establishing a positive 
rate of climb, the EGPWS caution lights extinguish and the aural alert will cease. 


The following system's inputs are used for Mode 3 operation: 


e Radio altimeter transceivers 
е Left and right ADIRUs 
e GPWS module 
e Landing gear handle switch 
e SMYDC 1 and 2. 
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The GPWC uses this data to detect mode 3 alerts: 


е Radio altitude 

e Inertial altitude 

e Inertial vertical speed 

e Barometric altitude 

e Barometric altitude rate 
e Flap angle 

e Gear position. 


The alert envelope is as follows: 


RADIO CLIMB RATES IN 
ALTITUDE FEET PER SECOND (FPS) 


(FEET) ay ` 
1500 FEET 60FPS 30FPS  15FPS 
p. 


ғғ 


SINK RATE SINK RATE 


2 


зо С 
50 100 150 200 250 300 


LOSS OF INERTIAL ALTITUDE (FEET) 
MODE 3A 


FIGURE26: ALERT ENVELOPE FOR THE MODE 3A (FROM AMM $34-49-00) 


1.6.5.15 FEEL DIFF PRESSALERT 


The elevator feel computer uses hydraulic pressure from the system A and B flight control modules. When 
there is a difference of 2596 percent between system A and system B metered pressure the feel differential 
pressure switch closes. When this switch is closed for more than 30 s, the FEEL DIFF PRESS light illuminates 
(Overhead panel). 


The FEEL DIFF PRESS belongs to the flight control (FLT CONT) master caution group (left side glareshield). 
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1.6.5.16 Overspeed 


Two independent Mach/airspeed warning systems (one for each side) provide a distinct aural warning 
(clacker sound), as long as the Maximum operating airspeed (VMO/MMO) is exceeded. The signal is 
triggered by the ADIRU. 


1.6.6 WEIGHT AND BALANCE 


The Airplane left the stand with a weight of 72,011kg; the weight was distributed as follows: 
е Operating Empty Weight: 47,090kg; 
e Passenger weight (148 adults and 2 children): 11,309kg; 
e Alast-minute change (LMC) corrected the final weight to take into account the no-show of 
one passenger (- 100 kg). 
е Hold weight (baggage!9): 2,912kg; 
е Block fuel: 10,700 kg. 


The taxing fuel weight was 115kg. The takeoff weight was 71,896kg. The regulated takeoff weight is 72,400 
kg.Takeoff Center of Gravity (CG) was 23.12. 


For this flight, the weight and balance determined by the crew of the Airplane was within the limits defined 
by the manufacturer. 


1.7 METEOROLOGICAL INFORMATION 


The accident occurred at 05:44 UTC. The pertinent Addis Ababa Bole International Airport, (HAAB) surface 
weather observations provided by the National Meteorological Agency of Ethiopia are as follows:- 


TABLE 13: MET DATA DURING THE EVENT 


MET REPORT HAAB 100300Z 


MET REPORT HAAB 100330Z 


MET REPORT HAAB 100400Z 


Wind RWY 25 06010KT 


Wind RWY 25 06010KT 


Wind RWY 25 05008KT 


RWY 07 07004KT 


RWY 07 06006KT 


RWY 07 05006KT 


Vis 10km 


Vis 10km 


Vis 10km 


CLD FEW 750M 


CLD FEW 750M 


CLD FEW 750M 


T/TD 13/11°C 


T/TD 13/11°C 


T/TD 13/11°C 


QNH 1028 HPA 


QNH 1028 HPA 


QNH 1028 HPA 


QFE 776.0 HPA 


QFE 776.2 HPA 


QFE 776.5 HPA 


METREPORT HAAB 1004307. 


MET REPORT HAAB 100500Z 


MET REPORT HAAB 100530Z 


18There was 205 kg of mail on board the Aircraft according to the load sheet 
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Wind RWY 25 05008КТ 


Wind RWY 25 06008КТ 


Wind RWY 25 07010KT 


RWY 07 05006КТ 


RWY 07 05008KT 


RWY 07 05010KT 


Vis 10km 


Vis 10km 


Vis 10km 


CLD FEW 750M 


CLD FEW 750M 


CLD FEW 750M 


T/TD 15/11°C 


T/TD 16/11°C 


T/TD 17/09°C 


QNH 1028 HPA 


QNH 1029 HPA 


QNH 1029 HPA 


QFE 776.6 HPA= 


QFE 776.8 HPA= 


QFE 777.0 HPA= 


METAR HAAB 100300Z 


METAR HAAB 100500Z 


07004KT9999FEW025 13/11 Q1028- 


06008BKT 9999 FEW 
16/10°C Q1029- 


025 


METAR НААВ 100400Z 


06008КТ 9999 FEW 025 13/110С Q1028= 


06:00(05:00 отс) 


FIGURE28: WIND FROM BELOW LINK 
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DATE AND TIME 10/03/2019 

PLACE OF ORIGIN HAAB 

Ү/ЅЕТ 31 НАДА 1004007. 

HAAB 51С МЕТ 01 УАТ) 100500/100900 HAAA 

HAAB ADDIS ABEBA C/D TURR FCST= 

TAF from Addis Ababa Bole International Air Port 

TAF HAAB 0921307. 1000/1106 09008КТ 99995СТ028 5СТ090 BECMG 1007/1011 12008KT BKT026= 


TAF HAAB 100330Z 1006/1112 12010G20KT САУОК BECCMG 1009/1012 16016KT BECMG 1012/1015 
10012G22KT= 


MET REPORT HAAB 1005007. 


Wind - runway 25: 060 degrees 8 Kt, and runway 07: 050 degrees 8Kt Visibility: 10km; few cloud 750 m; 
temperature: 16°C; dew point: 10°C QNH: 1029 hPa; QFE: 776.8 hPa 


MET REPORT HAAB 100530Z 
Wind - runway 25: 070 degrees 10Kt, runway 07: 050 degrees, 10Kt Visibility: 10km; few cloud 750 m; 
temperature: 17°C; dew point: 09°C QNH: 1029 hPa; QFE: 777 hPa 
1.8 AIDS TO NAVIGATION 
Not applicable 


1.9 COMMUNICATION 


The Ethiopian Accident Investigation Bureau obtained VHF communications information and transcribed 
pertinent portions of the communications between the flight crew and air traffic control. The VHF 
Communication frequencies involved were: Ground - 121.29 MHz, Tower - 118.1 MHz & Departure (radar) 
is 119.7 MHZ. 
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1.9.1 ATC Communication with ET- 302 


1. At 05:14 ETH-302 from stand 6 of main apron called ground control on VHF 121.9 MHZ and requested 
start engines and push back destination Nairobi FL 360; 


2. At 05:16 ATC approved start and push back clearance for ETH-302; 


3. At 05:24 ATC issued taxi clearance for ETH-302 to holding position RWY 07R-B 25R-Aand the pilot 
acknowledged; 


4. At 05:28 Airway clearances issued by ATC to ETH 302 and released to 118.1 MHZ; 

5. At 05: 30 ETH-302 contacted tower 118.1 MHZ and instructed to hold on alpha 07R; 

6. At 05:37 ETH-302 reported to tower ready for departure; 

7.4t 05:37:51 АТС issued take off clearance to ET-302 and contact radar on 119.7MHZ; 


8. At 05.39:17 ETH-302 contacted radar 119.7MHZ and reported SHALA 24A departure crossing 8400 
climbing 320; 


9. At 05:39:40 Radar controller identified ETH-302 and instructed to climb 340 able rights direct RUDOL 
and ETH-302 acknowledge; 


10. At 05:40:14 ETH302 reported unable to maintain SHALA 1A and requested RWY heading; 
11. At 05:40:20 ATC approved RWY heading; 


12. AT 05:41:15 ETH-302 reported to ATC they had flight control problem and requested to maintain 14,000 
and ATC approved; 


13. At 05:42:32 ETH-302 requested radar control to vector to home and approved; 


14. At 05:42:47 ATC instructed ETH-302 to turn right heading 260 and acknowledged; 
15. At 05:44:34 ATC called ETH-302 and requested if he could make left turn, but no respond; 
16, The ATC called ETH-302 repeatedly, but no response from ETH-302; 


1.10 AERODROME INFORMATION 


Addis Ababa aerodrome has two runways which consist of two parallel paved surfaces designated 07R/25L 
and 07L/25R. The elevation of the airport is 2333.5 m. The Airplane took off on runway 07R which was 
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3800m long and 45m wide. The runway was not grooved but visual inspection revealed a very smooth 
runway with proper crowning. 


Airport name Addis Ababa Bole Int. Airport 
Airport identification HAAB 

Airport operator Ethiopian Airlines Group 
Certificate number Adm. АС/01/2006 ETH/ 
Certificate dated 1 June 2015 

Certificate effective for 2 years 

Runway Direction 07R / 25L 

Runway Length 3800 m 

Runway Width 45m 

Surface Condition Asphalt Concrete 


The RWY has performed adequate skid resistance to ensure safe landing and takeoff for Airplane; the level 
of skid resistance provided by a pavement surface is expressed in terms of the surface friction value. The 
smaller values mean poorer friction and more slippery conditions.The runway surface condition (friction 
measurement or estimate of the braking action) at Airport is measured using a Mu-meter. According to the 
Airfield Services Division procedure the runway shall be measured by towing the Mu-meter back and forth 
five to ten meters from the centerline of the runway at 65 kilometers per hour. 

Bole International airport RWY friction test has been done by test speed which is indicated below by friction 
coefficient. 


Table14: RWY FRICTION COEF. VALUE 


No | RWYdesignation | Friction coefficient values (96) Remarks 
A |В C Average 

1 RWY 07R 58 |62 |54 58 Medium 

2 RWY 25L 66 |58 |67 63 Good 


Measurement has been carried out on a long line on each side of the center line, approximately 3m or the 
distance from the center line on which most operations took place. 


1.10.1 Aerodrome Inspection 


The EAIB investigation, Airworthiness group chairman and team members obtained permission to walk the 
runway and its sides to check for airplane debris and any evidence of a bird-strike or tail strike. The 
Investigators walked the area of runway 07R (12,400 feet in length) highlighted in green in the picture 29 
below. The length and width of the runway inspected was approximately 3,000 feet and 150ft to the left and 
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right of the centerline. The team started the search in the vicinity of taxiway C and extended toward taxiway 
D as well as back towards taxiway B. Those participating in the walk searched along in the grass and the 
runway side where small broken rocks were. The team walked two rounds along the same area but there 
were no bird remains and AOA vane wreckage. The investigation team confirmed that there was no evidence 
of a bird and AOA vane remains in the highlighted search area. The team also noted no evidence of damage 
to the runway surface in this area consistent with a tail strike. FDR data shows that Left AOA deviations 
began when theairplane was located over taxiway D. 


Area of search 


Previous lift off points of 
accident airplane 


PICTURE: 29 AREA OF SEARCH FOR AOA VANE & BIRD REMAIN 


The analysis part of Collins laboratory simulation test for the AOA vane was presented to the EAIB. Even 
though bird strikesmaybe one of the causes, a wide range of power quality problems and error sources that 
can affect an airplane's electrical and electronic systems resulting in unstable and erroneous AOA Sensor 
output signals were not analysed. 

Despite the two fatal accidents and the electrical problems associated with the AOA Sensors, Collins 
Aerospace did not evaluate the electrical installation and testing procedures being performed by Boeing 
production. 


The following partial list could have been considered in the analysis: 


a. Damaged EWIS resulting in short circuits or open circuits 
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pr 


Circuit component failures and overloaded circuits resulting in changes to rated voltage, 
current, resistance 

Reference carrier frequency and amplitude variations 

Improper bonding and/or grounding 

EMI, HIRF, Noise 


Mechanical failures 


moan 


Hence, the investigation team cannot comment and verify on the conclusions noted in Collin’s report. 


On both RWY sides there were stationed people who used to protect the area from Birds, whenever any wild 
animal or bird dies around the area they immediately collect it so as not to be attracted by other big birds or 
small carnivorous animals; therefore, according to their witness reports there was no bird or other remains 
found. 

The investigation team was also appraising of the bird control program at Addis Ababa International 
Airport. This consists of a number of individuals stationed in the grass area between the two runways. These 
individuals have shotguns which are used to startle noted birds so that they avoid the area immediately 
adjacent to the runways. 


1.10.2 RUNWAY (RWY) and TAXI- WAY (TWY) Markings and LGT 


Runway LGT edge elevated bi- directional and brilliance control of combination of white and amber lights. 
Threshold lights: Green light across displaced threshold 

TWY markings: Centerline. Taxi holding position edge TWY designator boards 

TWY LGT: Edge elevated Omni directional blue lights. 


1.10.3 RWY Infrastructure 


The runway, stop way and taxiway surfaces are all covered in tarmac. The aerodrome has night lighting. All 
of the obstacles are equipped with lighting systems. The runway has white runway lights, red runway end 
lights and green unidirectional threshold lights. The stop ways have red lights. Runway 25, which is 
equipped for instrument approaches, has centerline approach lighting over a distance. No operational 
anomalies were noted in the lighting either by the crew of flight MSR 851 or by the crews of having used it 
before and after the accident. 
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FIGURE 30: AIRPORT STRUCTURE 
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FIGURE 31: RWY & TAXI WAY LAYOUT 


The Addis Ababa Bole International Airport is the major hub for Ethiopian Airlines and one of the largest 
airports in Africa. The ultra-modern airport terminal was inaugurated on January 21, 2003. This terminal 
handles all international flights with its modern facilities. 


Addis Ababa Airport is the busiest airport in East Africa with a capacity of providing world class passenger 
and cargo services to more than 6.5 million international and domestic passengers each year. 
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1.11 FLIGHT RECORDERS 
The Airplane was equipped with a Digital Flight Data Recorder (DFDR) and Cockpit Voice Recorder (CVR), 
which were located in the aft cabin and aft cargo hold (respectively) section of the Airplane. 


FIGURE 32: DFDR AND CVR AS DISCOVERED ON THE ACCIDENT SITE. 


1.11.1 Digital Flight Data Recorder 


The Airplane was equipped with a FA2100 NAND DFDR manufactured by L3-com with part number 2100- 
4945-22 and serial number 001217995. 


On 11 March 2019, the DFDR was recovered from the accident site by the EAIB. On 12 March 2019 the DFDR 
chassis with the Crash Survivable Memory Unit (CSMU) attached were transported to the French BEA 
recorder facility for data downloading. 


The delegation from Ethiopia (EAIB) arrived at the BEA facilities. The team visited the BEA facilities and an 
agreement was prepared to describe how the readout operations would be performed. Following the 
signature of the executive technical cooperation program document, the recorder's data recovery operations 
started. National Transportation Safety Board (NTSB) of the United States of America as Accredited 
Representatives, advisors (Boeing, FAA and EASA) participated in the operation the Ethiopian EAIB had 
brought a suitcase containing the equipment that was recovered on the accident site: 

- Acomplete recorder (chassis and CSMU) 

- A CSMU separated from its chassis 
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- A chassis without its CSMU 


The information provided by the manufacture indicated that the Airplane was fitted with the following 


recorders. 


TABLEIS: FDR, CVR IDENTIFICATION 


FDR 


CVR 


Manufacturer 


L3-com FA2100 NAND 


L3-com FA2100 NAND 


Part number 


2100-4945-22 


2100-1925-22 


Serial number 


001217995 


001289168 


The opening ofthe recorders and data extraction were done following BEA FA2100 NAND procedure, which 
is based on the AIK Accident Investigator Procedure, FA2100 series, Rev 7 dated 16th September 2015 
published by L3 communications (reference 905-E1436-22). 


FIGURE 33: DFDR IN THE SUITCASE 


The memory puck was opened and the electronic board containing the memory component support was 
extracted. The memory board identification was P/N 205-E5458-04, S/N 001157901 and the flex 
identification was 024-E5675-20 REV, 1809-1. 
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FIGURE 34: FDR MEMORY BOARD, FLEX AND CONNECTOR 


The memory board was visually inspected with a Keyence microscope. Apart from the connector pads, the 
memory board was in good condition. There was no trace of impact. The two memory chips as well as the 
micro-processor were found in good condition. 


The recorder read-out was performed by BEA (Bureau d'Enquéte Analyses pour la sécurité de l'aviation 
civile) investigators for the Ethiopian Accident Investigation Bureau (EAIB) under the authority of Ethiopian 
investigators with the participation of the U.S National Transportation Safety Board (NTSB), The Boeing 
Company, U.S Federal Aviation Administration (FAA) and EASA. 


The downloaded file provided more than 73hrs of valid data, including the flight of the event. The FDR data 
were decoded using the Boeing data frame provided by the NTSB and described in the document Digital 
flight data acquisition unit 737 MAX Data frame interface control and requirements document, reference 
D226A101-6, rev E dated 10th January 2019. 


DFDAU INFORMATION 


The validity tests and the way the DFDAU provides the invalidity information to the FDR are defined inside 
the appendix B of 737 MAX Data frame interface control and requirements document. 
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The following has to be taken into account when analyzing the recorded FDR data: 


- FDAU records the invalidity pattern once 4 consecutive invalid values have been received. As a 
consequence, when an invalidity pattern is detected inside the recorded data, the 4 previous samples 
shall also be considered as invalid. 

- Taking into account the invalidity pattern (Data - Error code - Data - 0), an invalidity of a parameter 
during less than 6 samples cannot be detected inside the recorded data. Indeed, the FDAU would 
transmit in this case: 4 samples of data as if they were valid, then the invalidity pattern starting with 
the data and then only the error code (the 6% values recorded after the start of the invalidity). For a 
parameter recorded each second, up to 6s of invalidity may not provide any cue inside the recorded 
data. 


These impacts are illustrated in Fig 35 with the same parameter plotted twice (raw recorded values on the 
top and engineering values on the bottom). 


ET-AVJ, Boeing 737-8 max operated by Ethiopian Airlines 1311 - Parameter validity 
АО Addis-Abeba-Bole, 10/03/2019 - 


Dare: 07122019 | BEA 


Raw values 


/" Тһе 4 previous 
samples аге also - 


invalid = 
0 2224414 


Valid data — 


: А -50 
Engineering values 


361 


-100 15 Invalidity pattern 
DATA/Err code/DATA/00 


264390 


TCC (в) 


FIGURE35: ILLUSTRATION OF THE INVALIDITY RECORDING 
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Specific information for FDR data analysis 
Stab trim cutout switches positions 


No discrete parameter records the positions of the stab trim cutout switches. However, some recorded 
parameters provide information on these positions: 


- The discrete parameter of the manual electric trim command records command (up or down) only 
when both stab trim cutout switches are in the normal position. 


- The discrete parameter of the FCC trim command records command whatever the positions of the stab 
trim cutout switches are. When FCC commands are recorded, if no stabilizer motion is recorded, it 
means that at least one stab trim cutout switch is in the CUTOUT position. 


ET-AVJ, Boeing 737-8 max ораган by Ethiopian Airlines 11.16 - Stab trim switches position - 
AD Addis- , 10/03/2019 . DATE: 12082019 B E А 


ЕСС trim command recorded 
without any stab move 
IMPLIES 
Stab trim cutout switches in the 
CUTOUT position 


+——+ + 1—+ + 


Manual Electric trim 
UP 


Manual trim 
command recorded 
IMPLIES 
Stab trim cutout 
switches in the 
NORMAL position 

264430 264435 264440 264445 264450 
Cumulated time (second) 


FIGURE 36: STAB TRIM CUTOUT SWITCHES POSITION 


DOWN 


MCAS DETECTION 
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No discrete parameter records the MCAS activation. However, MCAS activation can be detected with the 
following recorded information: 


1. 


2 
3. 
4 


The autopilot is not engaged 
The flaps are retracted 


The initial stabilizer movement is commanded by the FCC in the Airplane nose down direction 


If stabilizer moves, the trim rate is 0.27?/sec. (The flap down trim rate is used during MCAS 
activations, even though flaps are up). 
If stabilizer did not move, the FCC command shall last during a time consistent with the MCAS 


computed duration. 


If a manual trim command was performed before, MCAS triggers after a delay of 5 s. 


ГЕТ-АУ3. Booing 737-8 max oporsiod by Ethiopian Airlines 11.18 - MCAS detection - 
AD Addis Abe Bole, 10032019 à оле онон). BEA 


SEL 
NOT SEL 
EL 

NOT SEL 
SEL 


05|- TE FLAP POSN LEFT [DEG] 2 - Flaps up (mandatory) 


1 + 1 t 


+ + + + + + + + + + + + 1 + + + 
ee 3 — FCC DOWN command (mandatory) 


pown FCC trim 
+ А | } + + + П + + + | А + А | А + + | 


(8 4a — Move toward nose down 
PITCH TRIM POSITION [PTU] 


4 + і 4 + + 4 L " + + + + + + + 


СС FORCE-PITCH CWS LOCAL (>0 = Nose Up) [LBS] E z = 
4b — despite pilot pulling aft 

+ } + 
РТО speed [Unit/s] 


4c- A speed reaching -0,27 units/s 


-0.27 units/s (MCAS speed) 


UP 6 —5 s after a manual trinrinpu 


pown Manual Electric trim 


264410 264415 264420 264425 264430 
Cumulated time (second) 


FIGURE 37: MCAS DETECTION WITH FDR DATA 


1.11.2 Cockpit Voice Recorder 


The Airplane was fitted with a FA2100 NAND CVR manufactured by L3 Communications with part number 
2100-1925-22 and serial number 001289168. 
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Е FIGURE 38: CVR CSMU 


On 11 March 2019, the CVR was recovered from the accident site by the EAIB. The CVR CSMU was 
transported to the BEA recorder facility for data downloading. The CMSU was found separated from the 
chassis during wreckage recovery. The read-out was performed by BEA under the authority of the Ethiopian 
Accident Investigation Bureau (EAIB), with the observation of the National Transportation Safety Board 
(NTSB) of United States of America. 


The memory board identification was P/N 205-E5458-04, S/N 001158641 and the flex identification was 
024-E5675-20 REV, 1809-1. 


FIGURE 39: MEMORY BOARD AND FLEX 
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The CVR memory board and flex were visually inspected with the Keyence microscope. There was no 
damage on the board and the connector was in good condition. 

A second observation with the X-ray was made, which confirmed that the connector soldering were in good 
condition. 


The memory unit recorded 2 hours, 4 minutes and 14 seconds of Airplane operation, which contained 2 
flights including the accident flight. 


1.11.3 Accident Flight CVR Transcript 


TABLE16: ACCIDENT FLIGHT CVR TRANSCRIPT 


Time (FDR Captain First-Officer ATC, ground staff, Warning, sound, 
UTC) Cabin crew, others remarks 
05:37:14 Ready for departure 
05:37:18 >Tower Ethiopian three zero 
two ready for departure 
05:37:20 >Please stand by 
05:37:22 >Standing by Ethiopian 
three zero two 
05:37:34 >three zero two clear 
for take-off runway 
zero seven right, zero 
eight zero ten 
(080/10) airborne 
Shala two alpha 
departure contact 
radar one nineteen 
seven (119.7) 
*MelkamMenged (bon 
voyage) 
05:37:42 >Airborne Shala two alpha 
departure contact radar one 
nineteen seven (119.7) 
Ethiopian three zero two 
cleared for take-off runway 
zero seven right 
05:37:50 Ready? 
05:37:51 Ready 
05:37:52 Stable 
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05:37:57 М1ТОСА 

05:37:58 Check 

05:38:00 Take-off thrust set 

05:38:01 Cross checked 

05:38:06 Speed increasing 

05:38:07 Checked 

05:38:13 Check Eighty knots 

05:38:14 Thrust hold 

05:38:15 Check 

05:38:32 SV: V one (V1) 

05:38:33 Rotate 

05:38:41 Positive rate 

05:38:43 Gear Up Clank sound 
(sound similar to 
gear lever moved 
to up) 

05:38:43 Stick shaker 
activates 

05:38:44 Gear up 

05:38:49 Master Caution, Anti-Ice 

05:38:50 *Eshi (OK) 

05:38:50 Trimwheel 
activation sound 

05:38:51 Trim wheel 
activation sound 

05:38:52 Trim wheel 
activation sound 

05:38:54 Autopilot 
disconnect wailer 
(3 times) 

05:38:55 Command 

05:38:58 Trim wheel 
activation sound 

05:39:00 Command Autopilot 
disconnect wailer 
(3 times) 

05:39:02 *Yeheendetnew ? (What’s 

going on?) 

05:39:04 Trim wheel 
activation sound 

05:39:06 *Eshi (OK), contact radar 
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05:39:08 Contacting radar 

05:39:09 Yeah 

05:39:10 C) 

05:39:11 » Radar Ethiopian three zero 

two Good Morning after 
airborne Shala two Alpha 
departure crossing eight 
thousand four hundred 
climbing three two zero 

05:39:17 Trimwheel 
activation sound 

05:39:23 Command engaged 

05:39:24 Ok, checked 

05:39:25 >Confirm calling 

three zero two 

05:39:27 >Affirm three zero two 

05:39:29 >Identified 

05:39:30 >Continue climb 

Flight Level three four 
zero when able right 
turn direct to RUDOL 

05:39:35 *Eshi (OK) 

05:39:36 >When able right turn direct 

RUDOL eh and eh Ethiopian 
three zero two 

05:39:45 Flaps up Flaps Up 

05:39:48 (*) 

05:39:49 Sound similar to 
flap lever 
movement 

05:39:50 *Eshi (OK) advise 

*aregew (go ahead) we 
are unable request to 
maintain runway heading 

05:39:55 Autopilot 
disconnect wailer 
(3 times) 

05:39:57 Request to maintain 

runway heading 

05:40:01 We are having flight 

control problem 

05:40:02 SV : Don’t Sink, 
don't sink 
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05:40:05 >Radar Ethiopian three 
Break, Break Radar 
Ethiopian three zero two, 
unable to maint.. to Shala 
one Alpha 
05:40:11 Request runway heading 
05:40:13 » Request runway heading 
05:40:14 >Ethiopian three zero 
two approved 
05:40:16 >Approved Ethiopian three 
zero two 
05:40:19 *Eshi (OK)  Flaps up 
speed 
05:40:23 SV : Don't sink, 
don't sink 
05:40:26 *Aregew endeze (Do it 
like this) 
05:40:27 Trim, Trim, Trim with me, | Trim, Trim UP SV : Don't sink, 
Trim with me, Trim with don't sink 
me, Trim ,Trim up, Trim 
up*kenegar kenegar 
(with me with me) (Name 
of the First-Officer) *Awo, 
Awo, aregew (Yes Yes do 
it) 
05:40:30 Trim wheel 
activation sound 
(2 clicks) 
05:40:31 SV : Don't sink, 
don't sink 
05:40:35 Stab trim cut-out? Stab trim 
cut-out? 
05:40:36 *Awo awo aregew (Yes, 
yes, do it) 
05:40:37 Stab trim cut-out 
05:40:44 pull up, pull up Pull up 
05:40:50 *Eshi (OK), advise we 
would to like maintain 
one four thousand. We 
have flight control 
problem 
05:40:56 >Radar Ethiopian three zero 
two we would like to 
maintain one four thousand. 
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We have flight control 
problem 
05:41:02 >Uh say again 
05:41:04 >We have flight control 
problem we like to maintain 
one four thousand 

05:41:08 >Approved and uh 

report intention 

05:41:10 >Will call you maintaining 

Ethiopian three zero two 
05:41:16 *Eshi (OK) Set one four Okay 
thousand 
05:41:17 Set one four thousand, one four thousand set 
*awo (yes) 

05:41:20 Over speed 
clacker started 
and continued 
until the end of 
flight 

05:41:23 (Uh sh) 

05:41:24 One four thousand set 

05:41:25 *Speedun (the speed) 

05:41:26 OK 

05:41:28 Speed 

05:41:30 *Eshi (OK), speed, 

*kenegar (with me). pitch 
up, pitch up, pitch up, 
yes, yes, pitch up 

05:41:33 Pitch up? 

05:41:34 Yes, with me Ok 

05:41:35 Yes Pitch up? 

05:41:38 Aha continue 

05:41:46 Eh trim *yeseral? (is it 

functional?) 

05:41:47 *Ayseram, wey beje 
lemokerew? (it is not 
working, shall І try 
manually?) 

05:41:49 *Esti (Try it) 

05:41:49 Click sound 
(similar to manual 
trim wheel handle 
extending) 
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05:41:50 Trim up 
05:41:54 Eh Eh *Ayseram (it is not working) 
05:41:56 Ok, with me, keep with Ehh!(sound of straining) 
me (Name of the First- 
Officer), keep with me, 
keep with me 
05:41:59 Yes 
05:42:00 We have to go up to one | Ok 
four thousand 
05:42:10 Request а vector to 
return 
05:42:12 Ok, Eh 
05:42:14 >Radar Ethiopian three zero 
two request vector to return 
to home 
05:42:20 >Eh, Confirm, eh, for 
hold or to come 
approach? 
05:42:26 >To commence approach for 
eh... 
05:42:27 Standby, Standby, 
Standby, 
05:42:28 >Standing by Ethiopian 
three zero two 
05:42:29 Ehhh (sound of straining) 
05:42:30 >(Turn) right turn 
two six zero 
05:42:34 Two six zero 
05:42:35 >Right heading two six zero 
Ethiopian three zero two 
05:42:38 
05:42:40 Two six zero 
05:42:41 Ok (Trink) (*) Sound similar to 
radio interference 
tone 
05:42:42 Pitch up *kenegar (with 
me) 
05:42:44 *Wede (towards) one 
four thousand, *eshi, 
mendennew ? (Ok, what’s 
it?) Master Caution? 
05:42:46 Master caution? 
05:42:47 Eha check *arge (verify) 
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05:42:48 
05:42:51 Master Caution anti-ice 
05:42:54 Left alpha vane Left alpha vane 
05:42:58 
05:43:04 Should we pitch *abren 
(together)? Pitch is not 
enough 
05:43:06 Straining sound "pitch is 
not enough" 
05:43:08 Put them up 
05:43:09 
05:43:10 *Eskezaw (Till then) 
Command *argew (put it 
on) 
05:43:12 Command 
05:43:12 Autopilot 
disconnect wailer 
(5 times) 
05:43:14 No, no, leave it, leave it, 
it's ok, it's ok, let's go up, 
let's go up 
05:43:16 Disconnect, let'S go back | *Eshi (OK) 
right heading 
05:43:28 Hof (straining sound), 
pitch up, pitch up, PITCH 
UUUP!!!! 
05:43:32 Pitch up *arge (to order) 
05:43:34 PITCH (with tone of 
distress) 
05:43:35 SV: Terrain, 
Terrain, Pull Up, 
Pull up 
05:43:36 Heh, Heh.... Pitch...Heh 
05:43:39 Eh Eh, MAYDAY MAYDAY (screaming sound) 
MAYDAY (screaming 
sound) 
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1.12 WRECKAGE AND IMPACT INFORMATION 


The accident site was located near Ejere, Ethiopia with a GPS location of 8.8770 N, 39.2516 E. 


The investigation team had much of the wreckage moved from the accident site to a secured location in 
Addis Ababa EAIB store. The wreckage pile measures approximately 5' high and about 30' in diameter. 
Assistance from Ethiopian Airlines recovered a number of flight control components - some are 
documented above during the on-site examination. Below is a detailed exam of each of the identified 
components. 


The Airplane impacted terrain at a farm field and created a crater approximately 10 meters deep (last 
Airplane part found) with a hole of about 28 meters width and 40 meters length. Most of the wreckage was 
found buried in theground; small fragments of the Airplane were found scattered around the site in an area 
about 200 meters wide and 300 meters long. Damages to the Airplane were consistent with a high energy 
impact. 


Flight path 
From North to South + 


FIGURE 40: TOP VIEW OF THE CRATER 
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“FIGURE 41: CLOSE VIEW OF THE CRATER BEFORE EXCAVATION - 
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1.12.1 Left Hand Engine (S/N602722) 


The left engine core was recovered from the site and examined by the group. The engine was reportedly 
recovered at a depth of approximately 10 to 15 meters depth on the left side of the excavation site. The 
predominant feature of the deformation of the entire remaining core was axial deformation. 


FIGURE 43: LEFT HAND ENGINE SECTION 


1.12.2 Right Hand Engine (S/N602695) 


The right engine core was recovered from the site and examined by the group. The 
recovered core of the right engine was more damaged than the left-hand engine. The engine 
was reportedly recovered at a depth of approximately 10 to 15 meters depth on the right 
side of the excavation site. 

The predominant feature of the deformation of the entire remaining core was axial 
deformation. 
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FIGURE46: R/H ENGINE - S/N 602695 - FAN DISK FIGURE47: R/H ENGINE - S/N 602695 - RETENTION LUGS - FRACTURED 


1.12.3 High Pressure Compresser (HPC) 


The HPC case was fractured and a portion of it remained with the core and the HPC stages were separated 


from the core. The 150 2"and 3" stage blisks were found together and were missing their airfoils. The 4^, 
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6", and the 8th to 10th stages were not found. The sth stage was found separately, and it was also missing 


ed circumferentially. The 
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its airfoils. The 7th stage web was fractur stator sections could not be identified. 
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FIGURE 48: - R/H ENGINE - S/N 602695 - HPCSTAGES 1 TO3 FIGURES 49:- R/H ENGINE - S/N 602695 - HPC STAGE 7 


1.12.4 Combustion Section 


The combustor was severely crushed and most of it was missing into pieces. 
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The Airworthiness Group comprised of members from Ethiopian CAA, Boeing, and NTSB convened at 
accident site, located near Ejere, Ethiopia, on March 12, 2019 to examine the Airplane wreckage with a 
specific focus on flight controls and the air data system components. 


FIGURE51: RECOVERED WRECKAGE PILE ON THE SITE 


1.12.5 Recovered Wreckage Examination 


The investigation team had much of the wreckage moved from the impact site to a secured location in Addis 
Ababa EAIB store. The wreckage pile measures approximately 5” high and about 30” in diameter. Assistance 
from Ethiopian Airlines recovered a number of flight control components - some are documented above 
during the on-site examination. Below is a detailed exam of each of the identified components. 
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FIGURE 52: RECOVERED WRECKAGE PILE 
1.12.6 High Lift Control System Components 


The Airworthiness group located components from the high lift control system at the accident site and 
within the wreckage pile located at the Addis Ababa airport EAIB store. 
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FIGURE 53: HIGH LIFT CONTROL SYSTEM COMPONENTS 
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Two parts of the actuation system were located and examined at the impact site. One consists of the 
ballscrew, yoke, gimbal and flap transmission; the other consists of just the ball screw, yoke, and gimbal (see 
Figures respectively). 


FIGURE54: FLAP TRANSMISSION & BALLSCREW FIGURE55: FLAP TRANSMISSION 


The installed location of each unit has not been identified. The position of each gimbal is consistent with the 
flaps in the fully retracted position. 

During the examination of the wreckage pile located at the Addis Ababa airport EAIB store, the 
Airworthiness group identified a total of 4 (including the ones identified at the impact site) trailing edge flap 
transmissions (there are 8 total); three of these had the ball nut and gimbal still attached. 
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FIGURES6: TRAILING EDGE FLAP TRANSMISSIONS AND BALL SCREWS 


Again, all three were found in the fully retracted position. There was one additional transmission portion 
that was found as well as three ball screw segments. All examined damage appears consistent with high 
energy impact. 


1.12.7 Leading Edge Slats Actuators 


The high lift control system consists of the trailing edge flaps and the leading edge slats. 


Three of the 8 leading edge slat actuators were photographed (see Figures below) at the impact site. The 
installed location for each actuator has not been identified. The actuator position, as photographed, is in the 
fully retracted position. 


During the examination of the wreckage pile located at the Addis Ababa airport EAIB store the 
Airworthiness group identified a total of three leading edge slat actuators at the impact site. The actuator 
position, as photographed, was in the fully retracted position. 
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57: SLAT ACTUATOR (POSITION UNKNOWN) FIGURE 58: LEADING EDGE SLAT ACTUATORS 


The Airworthiness group located components from the horizontal stabilizer control system at the accident 
site and within the wreckage pile located at the Addis Ababa EAIB store. 


Most of the located components of the stabilizer trim system were located once the wreckage was 
transported to Bole International Airport. The only part of the stab trim system located on site was the 
motor housing (see above). Referencing figure-54 above, the parts located in the wreckage pile at the 
airport consisted of the Primary Brake Housing (has the Lower Gimbal on it), the entire jackscrew 
(fractured into three pieces), and the ballnut (jammed onto the screw). Damage to the components of the 
stabilizer trim system is consistent with a high energy impact. 


1.12.8 Stabilizer Trim Notes & Position 


The figure below shows the relationship of the ballnut position along the ball screw. There is a safety rod 
which acts as a secondary load path should the ball screw fracture in service for any reason. It is attached to 
a separate set of secondary gimbals below the primary support gimbals on the primary brake housing and to 
the top of the ball screw. Figure 54 shows the safety rod and that it protrudes out from the ball nut. 
However, the fracture faces on the 5" long upper screw portion (note the measurement in Figure 53) match 
those found near the ballnut upper stop. This is consistent with the safety rod being pulled out several 
inches prior to final fracture. 

Two parts of the control system were located and examined at the impact site. One consists of aft cable 
drum; the other consists of the stab trim actuator (see Figures 59 & 60 below respectively). These 
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components do not provide any evidence of what position the horizontal stabilizer may have been at the 
time of impact. 


u | > ” $“ > g : à ' к Ж * T 


FIGURE59: AFTCABLE DRUM FIGURE60: STAB TRIM ELECTRIC MOTOR HOUSING 
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FIGURE 61: RECOVERED STABILIZER TRIM COMPONENTS 
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Examining the fracture surfaces, the upper screw segment fits with the fracture face just inside the ballnut 
giving a measurement between the stops on the ballnut and the upper ballnut stop of ~5”. Referencing 
Boeing document D251A122 (737NG Control Position Data), this measurement equates to a stabilizer trim 
setting of 1.5 degrees Airplane Nose Down (AND) or an indicated position of 2.5 units of trim. Although the 
data is for the 737NG, the position of the MAX stab trim holds the same relationship. According to Boeing: 


TABLE 17: STAB NOTES & POSITION 


Stab.Angle(deg) | Stab. Units 

Airplane Nose Down (Stab Leading Edge Up) Mechanical Limit | 4.71 -0.71 

Main Electric Nose Down (AND) Limit with flaps down (flap not | 4.45 -0.45 

up) 

Main Electric Nose Down (AND) Limit with flaps up 0.15 3.85 

Neutral Stabilizer 0 4.00 

Main Electric Nose Up Limit -10 14.00 
Airplane Nose Up (Stab Leading Edge Down) Mechanical Limit | -12.40 16.40 


Ballnut upper stop 


FIGURE62: UPPER BALLSCREW SEGMENT FIGURE 63: BALLNUT AND UPPER BALLSCREW SEGMENT 
PITCH CONTROL SYSTEM (ELEVATOR) 


The Airworthiness group located components from the elevator control system within the wreckage pile 
located at the Addis Ababa airport property. 
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FIGURE64: ELEVATOR PCU ACTUATOR PISTON 


The only components that were located for this system were the output torque tube, the mach trim actuator, 
a small portion of the Elevator feel and centering unit, and a small piece of the elevator input torque tube. 
Figure 55 above shows the recovered components of the elevator control system. Note that all components, 
like the lateral components show significant damage consistent with a high-energy impact. The upper 
torque tube was fractured in half. Only a small portion of the lower (input) torque tube was recovered along 
with a piston of the Elevator Power Control Unit actuator. The Mach Trim Actuator was found in the fully 
retracted position. 


1.13 MEDICAL AND PATHOLOGICAL INFORMATION 


Autopsy and body examination data made available by the Federal Police and foreign autopsy examiners. 
DNA analysis of all recovered human remains allowed the identification of all persons who were on board 
and autopsy examination concluded that the human remains were infection free. 


АП reports observed through clinical examinations the absence of burns, wounds and cyanosis. Some of 
them concluded that "the death is the consequence of a violent trauma, with projection of the passengers 
against a hard surface and ground impact of the airplane resulting in severe vital lesions that led to 
immediate death. 
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All passengers suffered even more severe physical consequences that did not allow any autopsy to be 
carried out. However DNA was extracted from all recovered human remains and all passengers and crew 
were identified. 

The medical forensic reports concluded that passengers died as a result of multiple fractures. 


1.14 FIRE 
There was no evidence of fire. 


1.15 SURVIVAL ASPECTS 


There were no survivers 


1.16 TEST AND RESEARCH 


Three Major tests were conducted:- 


1. Column force and manual trim force evaluation using B737-8- MAX CAE-Training Simulator at 
Ethiopian Airlines 

2. Flight deck environment and column force evaluation using the Boeing Engineering simulator (ECAB) 
in Seattle 

3. Manual Trim evaluation using Flight Controls Test Rig (FCTR) in Seattle 


1.16.1 Simulator Assessment of Control Column and Trim Wheel Force 


Upon the investigative committee decision, 3 simulation tests were conducted at a simulator facility located 
in Addis Ababa between July 19, 2019 and July 31, 2019. The sessions were conducted in a CAE 
manufactured B737 MAXlevel D full flight simulator to assess the control column forces that were present 
and evaluate the manual trim wheel forces that were required to operate the manual trim wheel at the time 
the flight crew tried to use it on the event flight. While the control column forces in the Level D simulator are 
certified to correctly reproduce control column forces in the actual Airplane, the same is not true for the 
stabilizer manual trim wheel. Post-accident testing revealed differences between Level D simulators and the 
actual Airplane which affect the feel of the manual trim wheel. These differences are thought to be caused by 
system inertia, in-flight vibrations, cable stretch, and other effects not included in the simulator model. 


These assessments enabled the investigation of a conversation from the cockpit voice recorder (CVR) that 
took place between the captain and the first officer. Particularly: 


e Conversation where the captain asks the first officer to pitch up with him at different points on the 
event flight 


114 


Aircraft Accident Investigation Report B737- МАХ 8, ET-AVJ December 2022 


e Conversation about the use of manual trim wheel where the captain asks the first officer to trim up 
and the first officer replied it is not working 


On all sessions carried out, the simulator was set up with the weight and C.G. values of the event flight and 
weather condition was set to the same condition that was present at the time of the event flight. 


In session 1, a survey was conducted to analyze the relationship between number of manual trim wheel 
turns and corresponding trim unit change. It was noted that a change in 1 unit of trim (cockpit indication) 
requires about 15 turns of the manual trim wheel. This finding agrees with the information supplied by the 
manufacturer. The Airplane was set up to the condition with thrust and trim values of the event flight when 
the crew moved the stab trim cutout switches to cutout. Then the pilot occupying the captain seat tried to 
climb to 14,000ft by pulling on the control column to evaluate the amount of force needed. The pilot on the 
first officer seat then started to pull together with the other pilot and together managed to establish a pitch 
attitude of 5-10 degrees. The forces needed from both pilots to achieve this were considered significantly 
very high and unbearable for the duration held. Then the pilot attempted to control the Airplane and return 
for landing with elevator authority only with the trim unit set at 2.3 and trim cutout switch set to cutout 
while adjusting thrust manually. The attempt was unsuccessful. 


On session 2, in order to qualitatively assess the force on the manual trim wheel through two turns at 
different speeds and trim conditions, speeds 220, 250, 300Kt and trim values 2.5, 3.5 & 4.5 were chosen 
respectively. 


The Airplane was then trimmed for level flight at 10,000ft and the hands off trim values were noted for all 
three speeds. 


TABLE 18: HANDS OFF TRIM VALUE 


Speed 
220 250 300 
Hands off trim value 6.8 6.2 5.3 
The following qualitative definitions were agreed at the start of the session. 


Assessmentlevel??: A = trim wheel not movable 


B = trim wheel barely movable (1 turn not completed) 


19Assessment level 
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С = trim wheel moves with great difficulty (2 turns not completed) 
D = trim wheel moves with some difficulty (2 turns completed) 


The trim was set to 4.5 then stab trim was set to cut out. Then the pilot tried to trim the Airplane nose up 
with the manual trim wheel while the other pilot maintained level flight by applying force on the control 
column. This test was repeated for trim values 3.5 and 2.5. 


The pilots took turns in evaluating the required force to turn the trim wheel. Both pilots also applied force 
together whenever one pilot was unable to move the wheel. The following table is a summary of the 
qualitative assessment 


TABLE 19: QUALITATIVE ASSESSMENT OF TRIM VALUE 
Trim position units 
= ү г ce ESI 


15.1 e ЧЕ 
32s 3 — TL 4 БЕНЕН БЕНЕН 
Hands offtrim values [68 | 62 | — 53 | 


On session 3, the qualitative assessment of the manual trim wheel through 2 turns was repeated and the 
same finding was observed. 

As the trim position from the event flight at the time the stab trim was in cutout and the pilots tried to use 
manual trim wheel was close to 2.5 units, this trim value was used to analyze the amount of miss-trim at 
different speeds and determine the relationship of control column force, trim wheel force and amount of 
mis-trim. 


The following table is a comparison of the mis-trim 


Mis-trim = hands off trim value - current trim 


TABLE 20: MIS- TRIM EVALUATION RESULT 


Speed 
220 250 300 
Hands of trim value 6.8 6.2 5.3 
Trim value Mis-trim value / assessment value 
4.5 23/D LI 0.8 
3.5 3.3 /С 2.7 1.8 
2.5 43/B 3.7 /А 2.8 /А 
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It was observed that the greater the mis-trim value, the greater the force required by the pilot on the control 
column to fly level flight and consequently the greater the force required turning the manual trim wheel. 


As the trim value from the event flight was around 2.5 units by the time the crew tried to use the manual trim 
wheel, even at a speed of 220 Kt the difficulty level of turning the manual trim wheel was level B (barely 
movable/ 1 turn not completed). 


The number of manual trim wheel turns that needed to be applied to get the hands off trim value was 
calculated by multiplying the mis-trim value by 15. The following table indicates the number of manual trim 
wheel turns required to reach the hands off trim value from a trim value of 2.5 units at three different 
speeds. 


TABLE21: MISTRIM EVALUATION RESULT 


Speed 
220 250 300 
Hands off trim value 6.8 6.2 5.3 
Mis-trim value when 4.3 3.7 2.8 
trim set at 2.5 
Number of manual trim 64.5 55.5 42 
wheel turns required 


Summary of observations 


1. The greater the mis-trim value, the greater the force required by the pilot on the control column to 
fly level flight and consequently the greater the force required to turn the manual trim wheel. 


2. Ata speed of 220Kt, the difficulty level of turning the manual trim wheel was found to be level B 
(barely movable/ 1 turn not completed) for the trim value of 2.5 units, which was the trim value on 


the event flight by the time the crew tried to use the manual trim wheel. 


3. For all speeds higher than 220Kt and trim set at a value of 2.5 units, the difficulty level of turning the 
manual trim wheel was level A (trim wheel not movable). 


4. Ittakes about 15 turns of the manual trim wheel to get a 1 unit trim change. 
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5. Onthe event flight during the time the flight crew tried to use the manual trim wheel, about 40 turns 
ofthe manual trim were required to get back to the neutral position. 


1.16.2 Engineering Simulator and Flight Control Test Rig Assesments 


From December 16 to 18, 2019, in support of the Ethiopian Airlines flight 302 (ET302) accident 
investigations, representatives from the EAIB, NTSB, BEA, FAA and Boeing, conducted test activities using a 
Flight Controls Test Rig (FCTR) and Boeing's engineering simulator (eCAB). Testing took place at a Boeing 
facility in Seattle, Washington. Key observations were made specific to human performance and operational 
factors of the ET302 investigation. The purpose of this document is to discuss the aspects of the findings 
most relevant to the flight crew actions during the accident sequence and provide a list of remaining 
questions based on the FCTR and ECABtesting. 


The main objectives of the FCTR and ECAB simulator testing were: 

e Simulate the manual trim wheel forces and experience the effort required to operate the trim wheel during 
specific out-of-trim conditions; 

e Familiarization of B737-MAX8 cockpit aural and visual alerting resulting from failure of an angle-of-attack 
(АОА) sensor failure; 


e Familiarization of B737-MAX8 flight profile characteristics, including unexpected MCAS activation during 
routine flight driven by erroneous AOA input; 


e Understand human performance/operational factors related to the ET302 flight crew's response to an AOA 
sensor failure and subsequent MCAS activation. 


TEST SCENARIOS AND PROCEDURES 

Test scenarios for the ECABand Flight Controls Test Rig (FCTR) were defined as follows: 

Scenario 1: (ECAB) Baseline 737-8 MAX configuration, no faults present. Scenario used to demonstrate the 
intended operation of MCAS during high AOA maneuvers. 

Scenario 2: (FCTR) Demonstration of stabilizer manual trim wheel forces. 

Scenario 3a: (ECAB) Erroneously high left AOA introduced after liftoff at 50 ft AGL; leave thrust at 9496 N1; 
run appropriate checklists (stick-shaker, airspeed unreliable, runaway stabilizer; return to ADD with stab 
trim in cutout. 

Scenario 3b: (ECAB) Erroneously high left AOA introduced after liftoff at 50 ft AGL; leave thrust at 9496 N1; 
mimic ET302 crew actions (based on FDR/CVR). 
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Scenario 4: (ECAB) Demonstrate updated FCC Software, (P12.1.2) erroneously high left AOA introduced 
after liftoff at 50 ft AGL; crew actions based on input from Operations and Human Factors Groups. 
For all ECAB scenarios, the following Airplane configuration was set at the start of the test: 


Lined up on HAAB runway 07R, engines running, all before takeoff checklists accomplished 
Altimeter set to read 7,625 ft. MSL (HAAB field elevation) 

Flaps: 5 

Weight: zero fuel weight 61,200 kg. / 134,923 lb.; fuel weight 10,700kg. / 23,589 Ib.; takeoff gross 
weight 71,900 kg / 158,512 Ib. 

C.G.: 23.1% MAC 

Trim: 5.6 pilot units 

Weather: clear; unlimited visibility 


1.16.2.1 ECab Description and Limitations 


The ECAB is a fixed-base simulator incorporating a flight deck cockpit (or "cab") that can be configured 
to represent different 737MAX models: -7, -8 or -9. For the tests outlined here, itwas configured as a B737- 
MAX 8 (the ET302 Airplane). The simulator is equipped with anumber of actual Airplane avionics boxes 


(as contrasted with simulating the avionics functionswith software). Boeing provided a presentation 
describing the design, capabilities, and limitations of the ECAB to the group during the first day of 
meetings. The ECAB is pictured in Figure 65 below. 
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737MAX E-Cab 


FIGURE 65: 737MAX SIMULATOR 
In scenario 3b, Simulator flight crews were to reproducethe ET302 flight crew actions based on CVR and 
flight data recorder (FDR) data. Following stick shaker activation after takeoff, the simulator crews were 
instructed to attempt to engage the autopilot three times, move flaps from 5 to 0, respond to two MCAS 
inputs using electric nose up trim per the FDR, move STAB TRIM CUTOUT switches to CUTOUT, 
unsuccessfully attempt to manually trim, move CUTOUT switches back to Normal, and respond to one MCAS 
input using electric nose up trim per the FDR. Reproducing the control actions recorded on the FDR resulted 


in loss of control of the Airplane. 


Finally, simulator participants were to mimic ET302 actions; however, after moving the STAB TRIM CUTOUT 
switches to CUTOUT, the crew was to work together to manually trim the Airplane using the trim wheel. The 
scenario involved both crew members each using one hand on the control column and one hand on the trim 
wheel. The limitations in replicating forces required moving the trim wheel in Level D simulators, noted in 
section B, also applied to the E-CAB; it was not able to reproduce the force that would have been required 
from the ET302 crew. The E-CAB was able to accurately reproduce the forces required by the crew to 
operate the primary flight controls via the control column. 


The third demonstrated the advantage of coordinated crew efforts to both make manual trim changes via 
the trim wheel (as had been done in FCTR testing) and control the flight path. However, because the actual 
forces on the manual trim wheel experienced by the ET302 crew were not observed in the FCTR, it is 
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unKnown if the ET302 crew could have successfully manually trimmed together, had they even considered 
this a technique to use. 


OBSERVATIONS FROM E-CABTESTING 


When attempting to imitate the ET302 flight crew actions, the simulator crews felt it was instinctual to 
use as much electric trim as needed to reduce column forces in response to MCAS inputs, recognizing 
that a sustained input on the electric trim switch was longer than typical inputs that pilots are 
accustomed to making during routine operations. 


Pilot flying workload and task demand were high when attempting to maintain flight path as column 
force increased with MCAS activation. Simulator crews considered column forces above 60lbs to be high, 
and above 80lbs. It became difficult to find a neutral column and maintain level flight. For reference, 
after the autopilot disengagement, the ET302 captain experienced column forces on average above 
901Һ5. Column loads about 60-80 165 were hard to differentiate — all are “high”. 


The main goal of the scenario was to fly the Airplane per the script that would duplicate the ET302 
sequence of events; little or no decision making was needed by the simulator crews. Even so, the 
workload appeared to be high, and it was deemed a "demanding task" by the crews to maintain flight 
path control; 


Participants noted the importance of mimicking the ET302 crew's actions as it allowed them to 
experience the time pressure the crew faced which was not as evident when reading the CVR/FDR data; 


Participants noted that the stick shaker was a distraction when managing the emergency. It's difficult to 
ask for help in holding column aft - that is hard to ask to share the column force. Normally only one pilot 
is applying force ; 

Although the accident scenario could not be perfectly replicated in the simulator due to differences in 
simulator crew reaction times and actions, the investigative team was able to better understand the rapid 
onset and complexity of the emergency and its effect on the ET302 flight crew's actions; 

A participant noted that MCAS trim is very fast; you don't realize how long you have to re-trim to get back to 
neutral; 
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1.16.2.2 FCTR Testing 


FCTR Description and Limitations 


The FCTR partially replicates the Boeing 737 flight deck environment, including control column and wheel, 
rudder pedals, and manual trim wheels, properly configured in front of two pilot seats (Figure 65). Boeing 
provided a presentation describing the design, capabilities, and limitations of the FCTR to the group during 
the meetings. The presentation notes that the FCTR correctly replicates the reach and operation of the 
manual trim wheel from the pilots' seats, and accounts for the kinematics (geometric constraints) of the 
manual trim system. The FCTR also replicates forces due to cable stretch and the inertia of masses moving 
within the system. The model driving the FCTR forces has been validated with flight test data at speeds up to 
VMO (340 KCAS). 


< P Е. 
FIGURE66: MODEL ЕСТЕ 


As it is noted above the main objective of the simulator sessions was to provide a better understanding of 
the accident flight and observe various messages, lights, various failure modes and flight deck effects related 
with the event flight. It was also to understand the flight crew workload during different scenarios. 


Because of limitations in reproducing trim wheel forces in Level D simulators, Boeing constructed the FCTR 
to replicate the forces needed to move the trim wheel in a B737MAX at various mistrim and airspeed 
combinations. A mistrim of -1.5 units at airspeed of 340 KCAS (VMO) was the combination that required the 
greatest effort to correct and was the most difficult mistrim/airspeed combination available in the FCTR1. 
When the ET302 crew discussed using manual trim during the accident flight, the mistrim was -2.7 units at 


airspeed of 340 KCAS. 
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Evaluating these forces was important in understanding the ET302 crew's ability to move the trim wheel. 
According to the cockpit voice recorder (CVR), the first officer indicated that he could not rotate the manual 
trim wheel. Both physical and psychological factors could influence his ability to move the wheel. 

Regarding physical factors, the force required to initiate rotation of the trim wheel might have exceeded the 
physical capabilities of the first officer; put simply, he may not have had the strength to initiate rotation. 
Also, grip (overhand or underhand), seat (body) position in relation to the trim wheel, and clock-position of 
the handle on the wheel (which would change the direction of the force vector required to initiate or 
maintain rotation) could all affect how easy or difficult it was to move the manual trim wheel handle. An 
understanding of these physical factors was gained from the FCTR testing, as it was difficult to turn the 
handle at forces less than those experienced by the ET302 crew. 


However, the testing did not allow the team to evaluate the control wheel forces experienced by the ET302 
crew because of a lack of flight test data to validate the forces at that speed and mistrim. 


Regarding psychological factors, there are several plausible explanationsfor why the flight crew was not able 
to move the manual trim wheels. First, the first officer's expectation of force needed to turn the wheel could 
have influenced his actions. Had the first officer expected the trim wheel to require less force than he 
encountered, it was possible that he interpreted force needed and the resistance he felt as the trim wheel 
being unmovable - and in the emergency he may not have had the attention resources to further diagnose 
why it was not moving. Further, there was no mention of high forces that may be required to trim manually 
in either the QRH or the Boeing FCOM bulletin issued following the Lion Air accident although the possibility 
is discussed in the FCTM. Excessive airloads on the stabilizer may require effort by both pilots to correct 
themis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual 
trimming. 


1.16.2.3 Trim Wheel Evaluation at the Flight Controls Test RIG (FCTR) 


Multiple scenarioswere executed to run different manual trim Wheel forces for ET-302 flight conditions on 
ground as well as at different speeds and altitudes using Flight Controls Test Rig (ЕСТЕ). 


A trim wheel evaluation was performed at the Flight Controls Test Rig (FCTR). Tests were done with 
Airplane on ground as well as at different speeds and altitudes with different trim settings. 


It should be noted that: 
- TheMaximum mistrim demonstrated on the ЕСТЕ is -1.5 units. 


- 15 wheel rotations are necessary for 1 unit of trim. 
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- The first test was conducted with Airplane on ground at zeroKnot. Expected force on the wheel was 10 
Lbs. 
It was noted that the wheel was easy to operate, the FCTR matched the physical Airplane very closely and 


that it was qualitatively close to CAE training simulator forces. The FCTR instrumentation recorded static 
force of approximately 9.3 pounds. 
The second test was conducted with Airplane at 12,000 ft, 250 Kt, in trim condition (expected 15 Ibs force). 
e It was noted that the wheel was а bit more difficult to operate but that it was still doable with one 
hand. It was qualitatively close to CAE training simulator forces. The FCTR instrumentation recorded 
static force of approximately 15 pounds. 


The third test was performed at 12,000 ft, 340Kt (VMO), in trim condition (expected 21 Ibs) force. 

e [t was noted that the trim wheel force become much more difficult to operate than in condition 2. 
The wheel motion became jerky, straining efforts to turn it. Impact onspeech. Qualitatively more 
difficult than on CAE training simulator. 15 turns would be tiring. Rig instrumentation recorded 
static force of 21 pounds. 

The fourth test was conducted at 15,000 ft and 340Kt (УМО), -1.5 units (mis-trim)?°, expected 35 lbs force. 

e It was noted that it was difficult to turn the wheel with one hand confirming the first officer's statement 
“it was not working" meaning "hard to move. Some participants expressed surprise at the difficulty. It was 
possible to turn the wheel with two hands although not convenient at all. The level of force for this 
condition was found to be between 30 and 40 lbs. It was agreed that difficulty would increase further 
outside the normal operating envelope (as in the accident case). 

As noted earlier, differences between trim wheel simulations (whether Level D or FCTR)?! and the actual 

airplane affect force-based comparisons between the two. Flight test data revealed that mechanical 

characteristics of the actual airplane (including inertia, in flight vibrations, and cable stretch) serve to 
increase the calculated force any specific individual pilot can apply to the manual trim wheel. Therefore 
these conclusions may not apply to use of the trim wheel on an actual airplane in flight. 


20When the first officer reported that he could not move the trim-wheel, the mis-trim was about 2.5 degrees at 340 kt 
21Differences between trim wheel simulations (whether Level D or ЕСТЕ) 
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OBSERVATIONS FROM FCTR TESTING 


At Maximum forces experienced during testing with -1.5 units of mistrim, the trim wheel was difficult to 
turn by most, if not all, participants when using one hand. АП participants were able to start the wheel 
turning, though most needed two hands to rotate the wheel completely through 360? multiple times. Using 
two hands (either "bicycle" technique by one participant or coordinated effort between two participants) 
made turning the wheel easier and resulted in greater success turning it through multiple rotations. Hand 
position (grabbing handle overhand or underhand), seat position, and handle location (top or bottom of 
wheel which would change whether the individual was pushing or pulling) could impact how easy or 
difficult it was to turn the wheel; 

* Participants experienced variability in the force needed to turn the wheel. To get past the points in the 
rotation where participants found it more difficult to input the necessary force to keep the wheel moving, 
some felt it helped to build up rotational momentum during the easier (lower forces) portions of the 
rotation to assist in the more difficult (higher forces) portions of the rotation; 


* The trim wheel must be rotated completely (360?) 15 times to move the stabilizer 1 unit of trim. To resolve 
a mistrim of -2.7 units as on ET302, the wheel would need to be rotated through 40.5 revolutions. In FCTR 
testing, the average force needed to turn the wheel at -1.5 units of mistrim (at 340 KCAS) was 40165. 
Participants had difficulty in initiating rotation of the wheel at this setting and found prolonged rotation 
fatiguing. The ET302 flight crew may have initially encountered greater force requirements due to the 
greater mis-trim condition on the accident flight that would have reduced after trimming. 


• It was noted that the force needed to rotate the wheel during ET 302 would decrease with each rotation as 
the Airplane approached an in-trim condition (a dynamic not reproducible in the FCTR.). Even so, initiating 
rotation and continuing for 40 revolutions on the accident flight may have been difficult. 
E-CABAND FCTR TEST AND RESEARCH SUMMARY 
Participants made the following observations: 
e As it was observed from SIM test MCAS trim is very fast; you don't realize how long you have to re- 
trim to get back to neutral; 
e Column loads about 60-80165 were hard differentiate - all are "high"; 
e It was difficult to ask for help in holding column aft - that was hard to ask to share the column force. 
Normally only one pilot is applying force; 
е Athigh column force, relaxing column position didn't provide much perceived relief in column force; 
e 5seconds delay after yoke trim stops, you have mentally moved on to something else - catches you 
off guard again; 
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e When column force loads is above 80 lbs, it was doable as a single pilot, but noticing the effort paid 
but Once column loads > 80 lbs, finding neutral position was difficult and harder to distinguish low 
load from zero load; workload appeared high "Demanding task" to maintain path control". It was also 
confirmed that very difficult trying to turn the trim wheel as the pilot holding around 60-80 lbs 
column force. 

It was observed that the greater the mistrim value, the greater the force required by the pilot on the control 
column to fly level flight and consequently the greater the force required turning the manual trim wheel. 


Moreover, the trim wheel must complete 15 revolutions to move the stabilizer by 1 unit (degree) of trim. 
Consequently, to resolve a mistrim of -1.5?, the wheel would have to be rotated through 22.5 revolutions; 
but to resolve a mistrim of -2.7? it would have to be rotated through 40.5 revolutions, i.e., 8096 more. 


1.16.3 Angle of Attack, AOA Values 


At 5 h 38 min 44 s, the LH AOA recorded values began drifting from the RH AOA recorded values; before that 
time, no clue of concern existed on the LH AOA recorded values. 


The first decrease of AOA wasby2.6? record (1 sample) before a sudden increase to more than 60? in half ofa 
second followed by a slower increase to 74.5? 
At 5 h 38 min 48 s, a master caution triggered. From that time, the primary AOA heat LH recorded values 


underlined a failure of the vane heating (first recorded OFF value at 5 h 38 min 51s, sampling rate of the 
parameter: 0.25 Hz). The reason for the master cautionwas the anti-ice left alpha vane indication. 


Note: the master caution was no longer recorded as active at 5 h 38 min 55 s. 


From the CVR transcript, at 5 h 42 min 48 s, the Captain requested the recall of the master caution. At that 
time, master caution had only triggered once. Following the master caution recall, the crew exchanged 
"Master Caution Anti Ice" and "Left Alpha Vane". 
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FIGURE 67: AOA VALUES DURING THE BEGINNING OF THE FLIGHT 


Although the FDR does not separately record both resolvers within the LH AOA sensor, recorded ADIRU and 
SMYD parameters are consistent with both resolvers providing the same erroneous values. Therefore, the 
investigation concluded that the failure impacted the signals provided by both resolvers of the LH AOA. 


According to the description provided in 81.6.3.3 it took between 3 to 5 s between the AOA heat failure and 
the triggering of the associated master caution. The LH AOA heat failure triggered at a time consistent with a 
single event leading to both heat failure and erroneous values from both resolvers at the same time. 


1.16.3.1 Impact Of AOA Failure on ADIRS 
Detection of the AOA failure by ADIRU 


As LH AOA vane heating failure occurred, LH ADIRU continued providing its parameters without any 
information of failure. 


LH ADIRU provided the recorded LH computed airspeed values. These recorded values never showed any 
invalidity pattern during the whole flight of the event. LH ADIRU provided output data without any 


invalidity information. 


Asa consequence, 
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- SPD flag never appeared on the PFD 
- ALT flag never appeared on the PFD 


During the flight of the event, the left and right recorded altitude values, the recorded CAS values and the 
recorded Mach numbers diverged after LH and RH AOA values divergence. 


ЕТ-АУ2, Bowing 737-8 max operated by Ethiopian Airlines 9.1 ADR dala. 
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FIGURE 68: AIR DATA PARAMETERS 


Although not explicitly recorded, the RH and LH computed total pressure values calculated from the 
recorded parameters were found to match. The differences between the recorded Mach number and 
between the recorded computed airspeed values were consistent with a difference in the corrected static 
pressure values resulting from the left ADIRU's use of the erroneous left AOA sensor data. 


The Airplane manufacturer recomputed the uncorrected static pressure for both sides, with the recorded LH 
and RH AOA values. 
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FIGURE 69: UNCORRECTED STATIC PRESSURE COMPUTED BY THE AIRPLANE MANUFACTURER 


Uncorrected static pressure values from both sides were identical. The difference between the LH and RH 
side corrected pressure values were therefore only due to the AOA correction. 


On the LH side, the erroneous LH AOA values induced corrected static pressure values greater than the true 
corrected static pressure values. This increase of the LH corrected pressure values induced: 


- LH pressure altitude values lower than the true altitude values 
- LH computed airspeed values lower than the true computed airspeed values. 


The RH air data parameters were not affected. 
IRS 


Most of the recorded IRS parameters did not show any variation following the AOA failure. On the contrary, 
the computed wind, on the left side, was clearly affected by that failure. 
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FIGURE70: IMPACT OF AOA FAILURE ON THE WIND COMPUTED VALUES 


The LH IRS was selected for the flight of the event. The invalid wind computed values impacted also the FMC 
that smoothed the values coming from the selected IRS. 
On the Captain display, the wind direction and the wind speed values were incorrect. 


Note: At 5 h 39 min 52 s, the difference between the computed LH and RH TAS values reached the threshold 
value used by FMC to detect inconsistency before then falling below the threshold two seconds later. If these 
2 samples resulted in FMC Target N1 parameters being declared invalid, it would not be immediately 
evident in the FDR data because of the 4 second time delay before recording an error code. 


1.16.3.2 Impact of AOA Failure on Engines and A/T 


IMPACT OF FAILED AOA VALUES ON FMC (ENGINE PART) 


For the takeoff phase, the N1 limit mode was the TO mode and the N1 recorded values corresponded to 9596 
of М1млх. At 7,000 ft of elevation, it indicates that the take-off was performed with Max. Takeoff Thrust. 
Indeed, at 7,000 ft of elevation, between 15?C and 20?C, the Max. Takeoff thrust corresponds to 9596 of N1. 
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FIGURE71: ЕМС PARAMETERS FOR THE ENGINES 
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FIGURE 72: FOCUS ON INVALID N1 DATA FROM FMC 


The start of the recorded invalidity patterns was denoted by the absence of line segments between 


According to the DFDAU design the four values preceding the invalidity pattern shall also be considered as 
invalid. They were plotted using diamond symbols. At the same time that the difference between the TAS 
computed on each side reached the FMC's threshold, N1 LIMIT MODE parameter (FMC) switched to "Not 


Available" 


1.16.3.3 Impact of AOA Failed Values on Auto-Throttle (A/T) 


During the whole flight of the event, A/T stayed engaged and remained in ARM mode. 


At 5 h 37 min 43 s, the TRA recorded values showed an increase, from 36? to 45? in 3 s. During that move, 
THR TORQUE-[1/2] recorded values stayed null. That move was manually performed. 


At 05 h 37 min 53 s, the TO/GA switch was pushed. A/T switched to the N1 mode. The A/T moved 
automatically the throttles forward (THROTTLE RATE CMD-[1/2] values, THR TORQUE-[1/2] values were 
positive). Once the throttles reached takeoff thrust, they remained there. As noted earlier, the normal 
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automatic reduction to climb thrust did not occur because the LH and RH TAS diverged by more than 25Kt 
before the FMC sensed that the Airplane had reached the thrust reduction altitude. 
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FIGURE 73: AUTO THROTTLE BEHAVIOR DURING THE FLIGHT OF THE EVENT 


As expected: 


- Ata recorded computed airspeed of 84Kt (5 h 38 min 14 s), the A/T switched to the THR HOLD mode 
(no other mode recorded). 

- When the Airplane altitude reached 800ft above the field elevation, computed from the LH baro 
corrected altitude (at 5 h 39 min 38 s, the Airplane reached a LH baro-corrected altitude of 8,416 ft), 
the A/T switched from THR HOLD to ARM mode. 


Note: the true altitude of 800 ft above the field elevation was in fact reached at 5 h 39 min 22 s (RH baro- 
corrected altitude of 8,416 ft). 


19s after the engagement of the ARM mode, the FMC detected the discrepancy between the LH and RH TAS 
values. At that time, the Airplane was descending and the Maximum height above field elevation it had 
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reached before was 950ft (from the LH baro corrected altitude). The thrust reduction altitude was not 
reached at that time. The TARGET N1-[1/2] and of the N1BUG DRIVE ENG[1/2] values transmitted by the 
FMC decreased to 8996 (5 h 39 min 58.7 s) with the flag NCD. Due to the invalidity flag, A/T function 
disregarded this new target. 


Note: By design, when no valid airspeed is available, the FMC changes the TARGET N1-[1/2] to the climb value. 
A М1 target value of 89% is consistent with a Climb phase. 


Summary on A/T behavior 


During the flight of the event, A/T was engaged in the automatic takeoff sequence and due to the erroneous 
LH AOA values: 


- LH and RH TAS diverged by more than 25 Kt. From 5 h 39 min 57, the ЕМС did not send any valid N1 
target values 


- The thrust reduction altitude was reached around 5 h 39 min 28 (computed from the RH baro 
corrected altitude). However, the FMC used the LH baro corrected altitude values, which were lower 
than the true ones. The FMC did not detect the thrust reduction altitude when it was sending valid 
engine commands. 


1.16.3.4 Impact of AOA Failure on SMYDC 
Stall management 
Following the increase of the left AOA values: 


- the autoslat system triggered (SMYDC 1), 
- the LH stick shaker engaged 
- the LH elevator feel shift triggered. 


At 5 h 39 min 56 s, the autoslat command ceased, the flap handle was at 0 position and flaps were moving up 
(flaps position lower than 1) with LH computed airspeed values reaching 230Kt and RH computed airspeed 
value 250Kt. 
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FIGURE74: AUTOSLAT, LEFT STICK SHAKER AND ELEVATOR FEEL SYSTEM 


At 5h 39 min 44s SMYDC-2 disabled the RH autoslat function due to the RH computed airspeed (230Kt 
reached). SMYDC1 disabled the LH autoslat function 12s later due to the invalid LH computed airspeed. 


SMYDC COMPUTED SPEED 


From 5 h 40 min 13 s the LH FC Minimum operating speed computed by the SMYDC 1 reached values 
greater than VMO; 3s later the LH stick shaker speed reached values greater than VMO. The erroneous 
nature of these computed speeds were not detected by any computer. 


From 5 h 41 min 30 s until the end of the flight by computing the equivalent Mach number, the left Stick 
Shaker Mach computed numbers were greater than the MMO (0.82); 


At 5 h 41 min 17 s, SMYDC1 computed FC minimum operational speed values greater than High speed buffet 
speed values. Both values were computed by the same computer SMYDC 1. 
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FIGURE 75: SMYD COMPUTED SPEEDS LIMITS 


The speed tape of the Airplane had a range of 120Kt (60Kt above and below the actual computed airspeed). 
As soon as the stick shaker speed reached values higher than the actual computed airspeed plus 60Kt, red 
and black stripes are displayed all along the border of the speed tape. 


During the flight of the event, the red and black stripes should have been displayed almost all the time from 
5 h 40 min 03s until the end of the flight (parameter Full Red black Stripes). 


1.16.3.5 Impact of AOA Failure on Flight Controls 


STABILIZER 
Stabilizer commanded moves 


Takeoff was performed with a trim position set at 5.7 units. 


During the beginning of the flight, several manual electrical trim inputs were recorded. These inputs 
reduced the force the captain needed to apply to the control column to maintain the desired path (this is the 
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normal and intended function of stabilizer trim in manual flight). Between the liftoff and the engagement of 
CMD A, the stabilizer moved between 4.9 and 5.9 units. When A/P was engaged, the stabilizer was at 5.6 
units. 
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FIGURE 76: STABILIZER COMMANDED MOVES 


Under A/P, 3 FCC A/P trims down commands were recorded and the stabilizer trim values decreased to 4.6 
units. When A/P disengaged, one single sample of FCC trim UP was recorded (Speed Trim activation). 


At 5 h 40 min 00 s, MCAS function triggered for the first time. At the end of the MCAS activation, the 
stabilizer position was 2.1 units. 


Manual electrical trim UP input was recorded from 5 h 40 min 14 s for 2 s. The stabilizer reached a position 
of 2.38units. 


At 5 h 40 min 21 s, MCAS triggered for the second time. At the end of the 274 MCAS activation, the stabilizer 
position was 0.4 units. 

Note: The MCAS function should have commanded stabilizer move towards Airplane nose down for 9.3 s but, 
during that period of time, the movement of the trim towards nose down command was limited to only 7s, the 


MCAS command was stopped by manual electrical trim up command. 
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The crew trimmed up for 9 s. The stabilizer position reached 2.3 units. 


At 5 h 40 min 43s, the MCAS function triggered for the third time. The stabilizer did not move. The Stab Trim 
Switches were then in the CUTOUT position. As manual electrical stabilizer trim command was recorded up 
to 5 h 40 min 375, the move of the switches into the CUTOUT position occurred between 5 h 40 min 38 s and 
5 h 40 min 43 s. 


According to the CVR transcript, the crew exchanged about the use of "stab trim cutout". At 5 h 40 min 37 s, 
the Captain expressed "yes, do it", followed by the F/O answer "Stab trim cut-out". 


Note: the investigation concluded that the F/O most likely moved the stab trim switches into the CUTOUT 
position at 5 h 40 min 38 s. 


At the end of the flight, (at 5 h 43 min 11 s), one pulse of manual electrical stabilizer trim up command was 
recorded (one single sample), followed 3s later by a pulse of 2 samples. The stabilizer reached 2.3 units. At 
those times, both Stab Trim Cutout switches were in the NORMAL position. 


The following exchanges were provided by the CVR transcript: 

05:43:09 "Put Them UP" 

05:43:11 “COMMAND” put it on. 

Note: It is assumed that the Stab Trim switches were back into the normal position at around 5 h 43 min 10 s. 
At 5 h 43 min 21 s, the MCAS function activated for the 47 time. 


The stabilizer position reached 1 unit. From that point until the end of the recording, no other commanded 
move ofthe stabilizer occurred. 


TRIM STABILIZER FORCE 
The Airplane manufacturer computed the force required on the trim wheel handle to move the stabilizer. 


Taking into account the force applied on the control column, it was possible to assess that the FO was pulling 
the control column until 5 h 41 min 49 s 


From the CVR transcript: 
- At5h41 min 50 5, the captain requested the F/O to try moving the trim manually. 
- At5h41 min 50.5 s: a sound similar to the trim wheel handle extension was detected. 
- At5h41 min 51 5, the first officerconfirmed "Trim up" 
- At5h41 min 55.5 s, the captain used an "expression of expectation" 


- At5h41 min 56 s, the first officer stated: "itis not working". 
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The time during which the F/O tried to manually move the trim was then between 5 h 41 min 51 sand 5 h 
41 min 56 s. 
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FIGURE 77: FORCE NEEDED ТО MOVE THE TRIM WHEEL 


By the time the FO tried to move the trim wheel manually a force between 42 lbs and 53 lbs was required 
according to the Airplane manufacturer computation, (see Figure 77). 


Elevator feel system 


Note: This part starts at the time the LH AOA sensor erroneous values. 
1.16.3.6 Impact of the Elevator Feel System before the A/P Engagement 


Before the A/P engagement, the recorded low force level underlined an Airplane rather properly trimmed in 
pitch. At that time, the stabilizer position was 5.62 units (nose up setting) and the elevators position was of 
3.5? (nose down setting). 
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FIGURE78: FORCE BEFORE A/P ENGAGEMENT 


1.16.3.7 Impact of the EFS on the Crew Feeling after the A/P Disconnection 


Note1: the Airplane manufacturer computed the pressure the elevator feel system delivered during the flight of 
the event. After the A/P disconnection, from the end of the 1* FCC trim down command until the end of the 
flight, the Elevator Feel system delivered a constant pressure that was the Maximum pressure. 


Note 2: the Airplane manufacturer confirmed that the FEEL DIFF PRESS master caution never triggered during 
the whole flight of the event. Indeed, when the conditions were met to close the feel differential pressure switch 
(before CMD A engaged), the duration of closure was shorter than the confirmation timer (30 s), after auto 
pilot disconnection, the conditions were not met anymore to close the feel differential pressure switch, 
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FIGURE 79: FELT FORCE AND ELEVATOR POSITION 


The gradient of force felt by the crew can be illustrated by the comparison between the force applied on the 
control column and the position of the elevator. Note that because the flight conditions resulted in the 
Maximum feel pressure, the activation of EFS had no effect on these forces. 


Between 5 h 40 min 10 s and 5 h 43 min 25 s, statistics were computed: 
- mean values of the smoothed elevator position: -3.0? 
- mean value of the smoothed computed average force: 94.4 lbs 
Figure 79 shows that from 5 h 40 min 10 s until the end ofthe flight: 
- an elevator position close to -3° required a force close to 94.4 lbs 
- adecrease of the elevator position below -3° required a force greater than 94.4 lbs 


- anincrease of the elevator position above -3° required a force lower than 94.4 lbs 


similar elevator position required similar force values 
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1.16.3.8 Impact of AOA Failure on Flight Director 
F/D invalidity periods 


With the erroneous values of the LH AOA sensor, the RH and LH pitch F/D diverged. LH and RH pitch F/D 
recorded invalid patterns for the first time at 05:38:51 


Then the RH pitch director did not experience invalidity pattern anymore but 3 other periods of invalidity 
were recorded on the LH pitch director. 


Each time the LH or the RH invalidity pattern was recorded, the recorded invalidity code (NCD - No 
Computed Data) indicates that the pitch F/D bar was removed from the PFD (biased out of view or BOV). 
The F/D fail flag did not trigger during the accident flight. 
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FIGURE 80: FLIGHT DIRECTOR DURING FLIGHT 
15 invalidity period 
At the time of the 15 invalidity, F/D was in T/O mode and the radio altitude was lower than 400 ft. 


Note: Below 400 ft, during TO mode, LH and RH pitch bars positions are compared with each other. If the 
difference between both pitches bars position exceeds a defined threshold, both pitch bars are BOV. 
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FIGURE 81: FLIGHT DIRECTORS - START OF THE FLIGHT 


05:39:00 


When the LH and RH AOA values diverged, LH pitch F/D commands recorded values quickly decreased to - 
32? while RH pitch F/D recorded values slightly increased to -0.4°. The difference between LH pitch F/D 
values and RH pitch F/D values were greater than the threshold above which FCCs comparators triggers and 
both F/D pitch were biased out of view. 


At 5 h 38 min 59 s, the radio altitude reached values greater than 400 ft RA increasing. The F/D was 
displayed again as per design, the comparator function stops above 400 ft. 


Note: The LH pitch F/D values were due to the erroneous LH AOA values and their impact on computed data 
(information sent by ADIRU 1 and SMYDC 1 to FCC A). 


Other invalidity periods 


During the remaining time ofthe flight, 3 other periods of invalidity were recorded: 


From 5 h 39 min 56 to 5 h 40 min 16 s 
From 5 h 41 min 22 to 5 h 41 min 33 5 
From 5 h 43 min 29 to the end ofthe flight 
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The computation of the LH F/D pitch behavior by the Airplane manufacturer allowed the detection of 2 
other periods of invalidity, with too small a duration for the invalidity to be recorded inside the FDR data: 


- From5h 42 min 01 for 0.5 s 
- From5h42 min 41 for3s 

Each invalidity period was due to the following conditions, described in the Airplane Maintenance Manual: 
- The F/D was in speed mode. 


- Тһе Airplane should have been climbing but the computed vertical speed value of the Airplane had 
been lower than the Climb threshold for 5 consecutive seconds. 


- Atthe LH side the Airplane approached to stall 
- LHF/D pitch commands (A/P not engaged) 
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FIGURE82: PITCH F/D COMMANDS 
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Inside the Figure: 


the LH and RH pitch F/D bar was plotted without the period when the pitch F/D bars were BOV 


the difference between the RH and LH pitch F/D command was plotted (LH F/D bar minus RH F/D 
bar) 


The recorded pitch F/D parameter is the angle between the center of the PFD (the symbolic Airplane 
in fact) and the position of the bar. To allow a better understanding of what the pitch bar requested, 
commanded pitch parameters were computed. For instance, at the beginning of the takeoff phase, the 
pitch F/D target is -10?. Prior to rotation, the target moves to around 15?. When the rotation 
occurred, the Airplane pitch increased, the target pitch (commanded pitch parameters) stayed 
almost constant around 15°, while the recorded pitch F/D bar parameters decreased. 


Note: No anomalies were observed in the RH pitch F/D bar positions the RH pitch F/D bar positions are then 
considered as valid positions based the Airplane attitude, altitude, and speed engaged modes.Except under the 
autopilot, the LH pitch F/D bar position was at least 10? lower than the RH pitch F/D bar. The commands 
provided by the LH pitch F/D bar were not consistent with the true Airplane status and the engaged modes, due 
to the effects of the erroneous AOA on the calculation of the minimum operation speed. 


Summary of AOA impact on F/D pitch command 


Once the LH AOA values diverged from the RH AOA values, the LH pitch F/D bar provided command that 
were not consistent with the true state of the Airplane and the engaged modes. 


LH F/D pitch bar was BOV (biased out of view) 6 times. Each time, airborne systems detected an important 
inconsistency: 


The first instance was due to a divergence between RH and LH pitch F/D commands, when the 
Airplane was below 400 ft. 


The remaining instances were due to the Airplane not deserving the minimum climb rate during 
level change mode. During manual flight, while the crew was pulling on the column and successful in 
making the Airplane climb, the pitch F/D bar would appear; however, once the Airplane starts to 
descend then the pitch F/D bar would be removed thus causing the disappearing and reappearing 
behavior of the pitch F/D bar. 

Each time the LH pitch F/D bar automatically reappeared, without any crew action.The underlying 
cause of the anomalous LH pitch F/D behavior was confirmed to be erroneous LH AOA sensor values. 
Erroneous AOA results in display of the IAS DISAGREE and ALT DISAGREE alerts. The appropriate 
NNC for these alerts is the Airspeed Unreliable NNC, which, as a memory item, requires that the crew 
turn off both flight directors. 
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1.16.4 Airplane Behavior under CMD A 


CMD AENGAGEMENT 


At 5 h 39 min 23 s, CMD A engaged in HDG/VNAV modes. 
Roll axis under CMD A 
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FIGURE 83: ROLL AXIS UNDER CMD A 


The roll axis under CMD A behaved as expected: 


RH and LH roll F/D commands were consistent with each other. 
Under HDG mode, the heading was kept within 2? of accuracy 


At 5 h 39 min 50s the crew selected a new heading (197?) and the A/P commanded a right bank to 


turn towards the new selected heading. However, the A/P was disconnected and the Airplane 
returned to wings level prior to reaching the new selected heading. 


Pitch Axis under CMD A 


With the VNAV SPD mode engaged, the Airplane was expected to climb towards the target altitude of the 
flight plan (32,000 ft) at a speed close to the FMC target airspeed. 


146 


Aircraft Accident Investigation Report B737- МАХ 8, ET-AVJ December 2022 


ET-AVJ, Boeing 737-8 max operated by Ethiopian Airlines 4.6 - Flight under CMD A 
AD Addis-Abeba-Bole, 10/03/2019 
T T T 


8700 


ALTITUDE 101325MB L [FT] === 
8400 


=e ERU ш 
s100 — ALTITUDE 101325МВ R -- — = == - — 16 - 
TITUDE 101325! өні = = = 
7800 } о — % 
I o 


—— 


7500 =~ | 
=: = m =i j=j --- E——E—4—31—7—-——4—4—3 ---- 1— 

dd COMPUTED АКӘРЕЁО RIKT] | | 
COMPUTED AIRSPEED L [KT] 


son Ес === === 
e 


240 — FC MIN OPERATING SPD [KT] 


vo e EROARE PER (ЕСЕДІ 


ON 
OFF 
ENGAGED | 


LEVELCHANGEPBLITEFDR 
MCP SPEED FCC 


ENGAGED 


дам a! ВРО 


4 | 
3 
я ELEVATOR POSITION L (#0 = Nose Down) [DEG] 

ы---- + 


{t+ —t- + — | 4+ + {++ ++ + 4+ + _f + ++ +++ 4+ 


y } 
5.4 
5.1 | 
+8 "PITCH TRIM POSITION [PTU] 
45 
E H | 


+ t + t 


+ + + + | 4 
7 


------------ғ-.- —3—4——À3————34-—M—3—————93-———d1—-—4 


8 

6 

4 

2 
PITCH ANGLE R ( >О = Nose Up) [DEG] 

0 

| i П 1 


1. 1 1 L П 1 1 1 
05:39:40 05:39:45 05:39:50 05:39:55 


4 П А п П 1 П i 1. 1 i П 1 i 
05:39:20 05:39:25 05:39:30 05:39:35 
UTC FOR (hh:mm:ss) 


FIGURE 84: CMD A ENGAGEMENT 
The longitudinal engaged mode (VNAV SPD) is aspeed mode. 


Note: In a speed mode, the auto throttle sets a fixed thrust for the specific phase of flight and the autopilot 
uses the elevators to adjust pitch angle to control the airspeed to the target airspeed, which is the higher of 
the Minimum Operating Speedand either, FMC speed or selected speed. At that time of the flight of the event, 


the erroneous the Minimum Operating Speed values computed by SMYDC 1was the higher of the two and 
was thus the target airspeed. 


As the target airspeed used by the autopilot was higher than the current LH computed airspeed, CMD A 
commanded a decrease of the Airplane pitch to increase the airspeed. 


As the flaps were retracted, the autopilot commanded 2 stabilizer moves towards nose down to reducethe 
amount of elevator deflection necessary to maintain the intended pitch angle. 


The crew engaged the LVL CHG longitudinal mode (speed mode also) at 5 h 39 min 42 s and increased the 


target airspeed (MCP setting), reaching 238 Kt at 5 h 39 min 49 s. After a transient period due to the speed 
setting, the Airplane pitch continued decreasing. 
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CMD A DISCONNECTION 


The autopilot uses a condition similar to the condition used by the pitch F/D to be BOV. In speed mode, 
when the autopilot is commanding a climb but the climb rate falls below a minimum threshold, the autopilot 
automatically disengages. 


With the decrease of the pitch, the vertical speed of the Airplane decreased. Climb rate dropped below the 
minimum climb rate threshold and CMD A automatically disengaged. 


SUMMARY OF AIRPLANE BEHAVIOR UNDER CMD A 
The Airplane behaved as expected on the lateral axis. 


On the longitudinal axis, the erroneous Minimum Operating Speed values computed by the SMYDC 1 (due to 
erroneous LH AOA values) became the target airspeed for the autopilot. As those values were greater than 
the current LH computed airspeed, the autopilot commanded a decrease of the Airplane pitch, leading to a 
stop of climbing followed by a start of descent. 


At the connection of CMD A, the Airplane was climbing with a vertical speed of around 1,000 ft/min 
increasing, a pitch value of around 7? increasing and a stabilizer position of 5.6 units. 


When CMD A automatically disconnected, the Airplane was descending with a vertical speed of around - 
1,400 ft/min, a pitch angle of around 1? and a stabilizer position of 4.6 units. 
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FIGURE85: CMD A - SUMMARY 
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ЕТ-АУЈ, Boeing 737-8 max operated by Ethiopian Airlines 4th AP warning 


December 2022 


AD Addis-Abeba-Bole, 10/03/2019 
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FIGURE86: A/P WARNING AT THE END OF THE FLIGHT 


1.16.5 Alerts and Warning 


GPWS 


05:43:25 


05:43:30 


At 5 h 40 min 3 s, the GPWS alert 'DON'T SINK' sounded twice. The previous Maximum recorded height was 


1,646 ft. 


The mean vertical speed of the Airplane before the Maximum value was around 12 ft/s. An alert triggering 
around 1,271 ft - after 229 ft of altitude loss was consistent with the GPWS Mode ЗА alert envelop shown in 


Figure 26. 


Once the alert was engaged, it continues until inertial vertical speed becomes positive. 


During all these alerts, the 'PULL UP' message should have been displayed on both PFD. 


At the end of the flight, the combination of the vertical speed and the height of the Airplane made the terrain 


and pull up warning trigger. 
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FIGURE87: GPWS ALERTS 
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Other alerts 
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FIGURE 88: ALERTS DURING THE FLIGHT 
MASTER CAUTION 


The first master caution triggered at 5 h 38 min 48 s during 7s. The reason for this master caution was anti- 
ice left alpha vane.This caution is triggered when low current is sensed in the AOA vane internal heater 
circuit. At 5 h 42 min 47 s, the crew exchanged about the master caution. 


Then master caution triggered a second time at 5 h 42 min 51 s during 2.5 s. The crew detected: “Master 
Caution/anti Ice/left Alpha Vane”. 
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FIGURE 89: MASTER CAUTION RECALL 


The third master caution triggered at 5 h 43 min 40s, but had no bearing on the sequence of events which 
led to the accident. 

1.16.6 IAS, ALT Disagree 
These alerts were not recorded in the FDR. Their time of appearance has been computed, as per 
computation, the IAS disagree alert should normally have triggered at 5 h 38 min 49 s, and stopped at 5 h 43 
min 28 s. It might have triggered again at 5 h 43 min 36 s during 4 s. As per computation, the ALT disagree 


alert should have triggered at 5 h 38 min 51s and stopped at 5 h 43 min 28 s. it might have triggered again at 
5 h 43 min 36s during 4s. 


Over speed 


Over speed warning RH side triggered at 5 h 41 min 21 s and stayed engaged until the end of the recording. 


Over speed warning LH side triggered at 5 h 41 min 33 s for 15.5 s, at 5 h 42 min 02 s for 8 s and at 5 h 42 
min 45 s. It stayed engaged until the end of the recording. 
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1.17 ORGANIZATIONAL AND MANAGEMENT INFORMATION 
1.17.1 The Operator 


The Ethiopian Airlines group/Operator (ETAG) has valid Air Operator Certificate (АОС) number CATO- 
01/270295 


The Ethiopian Airlines group operates a total of 126Airplanes consisting of: 


TABLE 22: AIRPLANE IN TYPE 


No Airplane type Total 
1 Airbus A350 14 
2 Boeing787-8 19 
3 Boeing B787-9 6 
3 Boeing 767-300 6 
4 Boeing777-200 16 
5 Boeing777-300 4 
6 Boeing B737-800 20 
7 B737-700, 10 
8 В737-МАХ8 4 
9 0-400 27 


Ethiopian Airlines (Ethiopian) is the flag carrier of Ethiopia. It commands а lion's share of the pan African 
network including the daily and double daily East-West flight across the continent. Ethiopian currently 
serves more than 100 international and 21 domestic destinations operating the newest and youngest fleet. 


Ethiopian Airlines, which is owned by the government of Ethiopia, has grown over the last two decades as it 
has capitalized on a strategy connecting markets across the African continent with European, North& South 
American, , and Asian destinations via its hub in Addis Ababa. 


1.17.2 Ethiopian Airlines Pilot Training School 


The Pilot Training School was commissioned in 1964. The development of this training facility has made 
Ethiopian Airlines self-sufficient in meeting its requirements for pilots. This is accomplished through the 
engagement of highly qualified and experienced the Ethiopian Airlines training staff. Over the last 50 years, 
the Pilot training school has trained pilots for African and the Middle East countries.The pilot training and 
the academy programs and facilities have acquired praise from experienced American and other foreign 
pilots. 
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The Pilot Training School currently offers accredited training programs for Commercial Pilot License with 
Instrument and Multi-engine Rating (CPL/IR/ME) and Multi-crew Pilot License (MPL). 


The Pilot Training School offers a comprehensive Commercial Pilot License with Instrument and Multi 
engine rating for over half a century. The school has highly experienced instructors for both flight and 
ground training. In addition, Ethiopian airlines have equipped it with all the necessary facilities: simulators, 
Airplanes (glass cockpit DA 40NG and Cessna 172) and well equipped ground classrooms and computer 
based training rooms. The syllabus is developed based on Ethiopian Civil Aviation Authority Regulations and 
ICAO requirements for Airline Transport Pilot License (ATPL), CPL and IR/ME Requirements. Moreover, due 
consideration is given to fulfill EASA ATPL theoretical knowledge requirements. Hence, The EASA and JAA- 
FCL detailed theoretical knowledge training syllabus is benchmarked for completeness and determination of 
scope and level of details. 


Ethiopian airlines pilot training follows an integrated syllabus for the ground and flight training. The 
theoretical Knowledge Courses comprise a total time of 920 class hours, including 80 hours for general 
English and 120 hours for Aviation English course. The CPL training also trains and offers regulatory body 
requirements, such as the ICAO English Language Proficiency requirements that necessitate the provision of 
structured Aviation English Training in the Pilot Training School. It also provides rating services for ICAO 
Level 4 English Requirements for Pilots. 


The training program guides students seamlessly from ab-initio training to airliner type rating, using 
simulation designed for multi-crew training. It also addresses the increased rates of loss of control in airline 
operations through Upset Prevention and Recovery Training (UPRT). In addition, train the trainees to 
combat the continuing dominance of multi-crew human factors in accidents through threat and error 
Management (ТЕМ) and Crew Resource Management (CRM). 


1.17.3 ETHIOPIAN MRO 


Ethiopian MRO Services is a division of Ethiopian and was established in 1957 to provide MRO services for 
Airplanes, engines and components of Ethiopian and third party customers. The primary base of Ethiopian is 
at Bole International Airport, Addis Ababa, Ethiopia. The Ethiopian MRO has an advanced maintenance base, 
which is fully operational for Airframe maintenance up to D-Checks, Engine, Overhaul, Components repair & 
overhaul, Light Airplane maintenance and technical, and management assistance for other airlines. The 
maintenance base is certified by the US- Federal Aviation Administration (FAA). 
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Ethiopian MRO is utilizing "Maintenix", a state of the art MRO management IT system also selected by 
Boeing for Gold-care program. The values of Ethiopian MRO focus on exceptional customer satisfaction. 


Ethiopian MRO has the capability to perform full airframe checks, including Heavy Maintenance on Boeing 
and Bombardier models of Airplanes at its base station. 

The base airframe maintenance comprises various dedicated shops. These include Structures shop, Interior 
Shops, Non-Destructive- Testing (NDT) shop, Machine Shop. 

Ethiopian MRO Engine shop has full overhaul capability of CFM56-3/7, PW120, and GTCP331-200 APU as 
well as modular maintenance capability for PW2000, PW4000 engines supported by various repair shops. 

In support of its engine overhaul facility, Ethiopian is utilizing a fully equipped with up to 100,000 pound jet 
engine test cell and two modern turboprop engine test beds. 


The base station also has different mechanical and avionics shops with a repair capability of components on 
Boeing and Bombardier model of Airplanes. These include Pneumatic, Hydraulic, Fuel, Wheels & Brakes, 
Electrical, Communication & Navigation and Instrument shops.Ethiopian MRO provides Engineering support 
to Ethiopian Flight and third party customers. 


1.17.4 OPERATION MANUAL (OM)-PART A 
1.17.4.1 Captain Duty and Responsibility 


Some of the Captain responsibilities according to the Operation Manual (OM)-part A subchapter 1.5, is 
directly and specifically responsible for, and is the final authority as to, the operation of the Airplane. 
Therefore, the Captain is responsible for ensuring the Airplane is in condition for safe flight and must 
discontinue the flight when un-airworthy mechanical, electrical, or structural conditions occur. 

In regards with defect report, the OM-part A section 1.5 part 6.1 and 6.2 described that Captain has the 
following responsibility: 

a. Conducting safe, efficient and secured flight in compliance with appropriate ATC and government rules, 

regulations, policies and procedures specified in the company Flight Operations Manual System. 


b. The safety of all passengers, crew members, mail and cargo onboard when the doors are closed. 


c. The operation and safety of the Airplane , its proper servicing, and the maintenance of airworthiness from 
the moment the Airplane is ready to move for the purpose of taking-off until the moment it finally comes to 
rest at the end ofthe flight and the engine(s) are shut down. 


155 


Aircraft Accident Investigation Report B737- МАХ 8, ET-AVJ December 2022 


d. Cooperating with the flight dispatcher in accordance with policies and procedures specified in the flight 
operations manual and shall have final authority for decisions regarding airworthiness of the Airplane and 
flight planning. 


e. Delegating his responsibility for the safety & security of the Airplane and its cargo as well as the 
passengers while on the ground to the company's representatives or to specific crew members. 


f. Ensuring that standard and emergency procedures and regulations are known and adhered to by all crew 
members in the air and on the ground, including adherence to the prescribed cockpit checklist. 


g. Coordinating the duties of the respective crew members in flight and on the ground to ensure that the 
provisions outlined herein are complied with; 


h. Familiarizing himself with the records of First Officers and trainees and for giving them the fullest 
possible benefit of his experience in order to improve their proficiency and bring them up to a standard 
within their category. This shall include giving permission to first officers to perform takeoffs and landings 
considering operational capabilities and requirements. Whenever a First Officer performs takeoffs or 
landings, the Captain shall be prepared to take control immediately when such actions become necessary. 
The PF shall not allow the First Officer to taxi the Airplane during ground maneuver. 


I. Acting within regulations in the best interest of Ethiopian at all times and taking into account all Known 
factors. 

j. maintaining a proper liaison with supervisory staff at all stations in order to ensure an efficient and 
punctual operation. 


k. monitor, check and verify the navigational performance, maintaining a particular RNP and accuracy 

of the present position of the Airplane during all phases of flight, after prolonged in-flight operations 

and before commencing approaches, by using the FMS RNP/ANP alerts or a VOR/DME distance and 

bearing against FMS fix distance/bearing of the same station. 

1. the PIC ensures the continuous operation of the recorders such that for the flight recorder, the 

Airplane begins its takeoff roll until it has completed the landing roll and for the cockpit voice 

recorder, the initiation of the pre-start checklist until the end of securing Airplane checklist. 

(ЕСАЕА58.5.1.24) 

Note: flight crews are required to make the proper operational tests before every flight. 

m. decide whether or not to accept an Airplane with defects allowed by the CDL or MEL. 

n. ensure that the pre-flight inspection has been completed. 

O. ensure the proper implementation and application of the manufacturer provided procedures and 
checklists approved for use by Ethiopian. 
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p. ensure that the Airplane carries sufficient required fuel, oil and additional fuel if operationally 
required. (FOM 2.12) 
q. the pilot to whom conduct of the flight has been delegated shall, in an emergency situation that 


requires immediate decision and action, take any action he considers necessary under the 
circumstances in such cases he may deviate from rules, operational procedures and methods in the 
interest of safety to FOM 1.5 (6.5). 


r. the captain is responsible for the safety of his Airplane and its contents throughout the time he is in 
command. 


Emergency Authority of the Captain 


ETH FOM 6.5, 1-4 describes that: 

The captain is permitted to deviate from prescribed rules, regulations, minimums, company policy and 

procedures as required for safety of flight considerations in emergencies. An Airplane in distress has 

the right-of-way over all other air traffic. Air traffic control should be kept informed of deviations from 

clearances of flight plans and will give priority to an Airplane that has declared an emergency. 
Dumping fuel to meet LGW limitations is an option of the captain's emergency authority.The captain 
may exercise his emergency authority to exceed the Maximum LGW if the landing is necessary as the 
result of an incident or a mechanical irregularity and he determines that such a landing would be safer 
than dumping fuel. 
In an emergency arising during flight time the captain shall keep the appropriate air traffic control or 
services facility and flight control fully informed of the progress of the flight. 

Whenever emergency authority is exercised, the captain shall submit a written report of any deviation 

to the VP flight operations within 2 days after the flight is completed. 


1.17.4.2 The First Officer is Responsible For 


a. attending pre-departure briefings, be fully aware of the intended flight planned route, contents of 
dispatch releases sheet, meteorology forecast conditions, NOTAMS and any other evaluation data. 


b. is responsible for the completion of the required forms like load sheet, trim sheet and fuel sheet etc. 
during unassisted revenue departure 


c. performing checks and drills, normal and emergency, in the manner prescribed by current flight 
operations manual. 


d. monitoring the execution of emergency checklist actions whenever possible. 
e.conducting radio communications, recording flight progress and importantcommunications 
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f. keeping the captain informed of NAV aid and communication frequency changes, ensuring that all 
facilities are properly identified. 


g. monitoring the flight at all times, checking that correct procedures and techniques are being 
followed. in particular he must advise the captain clearly and concisely if and when, the Airplane 
departs significantly from its intended flight path e.g. climbing through a cleared altitude on 
departure, or going below glide slope on ILS approach, or whenever he considers that a hazardous 
situation is developing. 

h. complete a periodic crosscheck of instrument indications of both captain and first officer instrument 
panels. 

i. monitor, check and verify the navigational performance, maintaining a particular RNP and accuracy 
of present position of the Airplane during all phases of flight, after prolonged in-flight operations and 
before commencing approaches, by using the FMS RNP/ANP alerts or a VOR/DME distance and bearing 
against FMS fix distance/bearing of the same station. 

j monitor destination, destination alternate and en-route alternate(s)weather information while en- 
route. 


k. carry out any other duties required by the captain. 

1. record any system or component malfunction in the Airplane maintenance logbook (AML) when 
instructed by the captain. 

m. maintain competency at all times to carry out basic navigation procedures using conventional 
methods. 


n. the assume command of the Airplane while in flight in the event of incapacitation of the captain and 
take over the responsibilities implied. 


о. first officer is not allowed to taxi an Airplane under any circumstances. 


p. carry out his duties as defined in this manual and/or other relevant manuals and instructions and in 
conformity with legal requirements. 
q. check and compute the take-off and landing weights, and pass the correct v speeds. 


r. assist the captain in conducting a safe and efficient operation of the Airplane . Maintain a special 
relationship with. 


1.17.5 Ethiopian Airlines Flight Crew Operations Manual (FCOM) 
Normal Procedure Chapter, Section 21 "Amplified Procedures" section "Preliminary Pre flight Captain or 
First Officer" included in part: ... 
Maintenance documents...................... Check 
MAINT light.................. Verify extinguished 
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Pilot Flying 
The following request calls are made by the Pilot Flying (PF): 

1. Configuration requests 

2. Thrust requests 

3. MCP requests 

4. Checklist requests 
Decision calls are made by the PF. They are in effect statements of intention. The compulsory calls are listed 
below. It must be appreciated that any other decision calls can be made by the PF if he thinks that the 
information is important and enhances CRM. This becomes particularly relevant during non- normal 


procedures. 

MACH AIRSPEED WARNING 

TEST switches ................. eene Push, one at a timeVerify that the clacker sounds. 

STALL WARNING TEST switches............... Push and hold, one at a timeVerify that each control column 


vibrates when the respective switch is pushed. 

Note: The stall warning test requires that AC transfer busses are powered for up to 4 minutes. 

Note: With hydraulic power off, the leading edge flaps can droop enough to cause an asymmetry signal, resulting 
in a failure of the stall warning system test. Should this occur, obtain a clearance to pressurize the hydraulic 
system, place the "B" system electric pump ON and retract the flaps. When flaps are retracted repeat the test. At 
the completion of the test, turn the "B" system electric pump "OFF" 


Pilot Monitoring 


The Pilot Monitoring (PM) will make all the following calls: 
1. Altitude calls 
. Speed calls 

3. Approach Parameter Deviation calls 

4. Instrument calls 

5. Lighting calls 
If a call is valid and understood, it is acknowledged by the corresponding crewmember with the appropriate 
response. This does not apply to the V1 and VR calls as the response is a standard action. If a standard call or 
FMA call is responded to by another standard call or FMA call, the response “CHECK” is omitted. Calls made 
by the auto-callout system are not to be made by the PM unless the system is inoperative or fails to make the 
call. 
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1.17.6 Approach to Stall or Stall Recovery 


An approach to a stall is a controlled flight maneuver; a stall is an out-of-control, but recoverable, condition. 
However, the recovery maneuver is the same for either an approach to stall or a fully developed stall. 


A stall warning should be readily identifiable by the pilot, either by an artificial indication (stick shaker) or 
natural indication (initial buffet). During the initial stages of a stall, local airflow separation results in 
buffeting, giving a natural warning of an approach to stall. Stick shaker operation will usually precede initial 
buffet as a stall warning indication. In some cases, near cruise altitude and cruise Mach, the stick shaker may 
be simultaneous with the initial buffet. 

Do all recoveries from approach to stall as if an actual stall has occurred. Immediately do the following at 
the first indication of stall (buffet or stick shaker). 

If the Airplane is stalled, the recommended steps are to hold the control column firmly, disengage the 
autopilot and auto throttle, then smoothly apply nose down elevator to reduce the angle of attack until 
buffet or stick shaker stops 

Note: Do not use flight director commands during the recovery. 
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TABLE23: STALL RECOVERY PROCEDURE 


Pilot Flying Pilot Monitoring 
»Initiate the recovery: eMonitor altitude and airspeed. 
*Hold the control column firmly. eVerify all needed actions have been done 
»Disengage auto pilot and auto throttle. and callout any omissions. 


eSmoothly apply nose down elevator to reduce the [Callout any trend toward terrain 
angle of attack until buffet or stick shaker stops. Nose contact 
down stabilizer trim can be needed*. 


«Continue the recovery: *Monitor altitude and airspeed. 
«Кой in the shortest direction to wings level if eVerify all needed actions have been done 
needed. ** and callout any omissions. 
e Advance thrust levers as needed. eCallout any trend toward terrain 
eRetract the speed brakes. contact 
*Do not change gear or flap configuration, eSettle FLAP lever as directed. 
except 


¢During lift off, if flaps are up, callforflaps1. 


е Complete the recovery: eMonitor altitude and airspeed. 
eCheck air speed and adjust thrust as needed. Verify all needed actions have been done 
eEstablish pitch attitude. and callout any omissions. 
eReturn to the desired flight path. eCallout any trend toward terrain 
«Ке-епраре the autopilot and authotrottle if contact 

desired. 


WARNING:*If the control column does not provide the needed response, stabilizer trim can be 
needed. Excessive use of pitch trim can aggravate the condition, or can result in loss 
of control or in high structural loads. 


WARNING: **Excessive use of pitch trim or rudder can aggravate the condition, or can result in loss of 
control or in high structural loads. 
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1.17.7 Airspeed Unreliable 


MAX FCTM 8.19 non normal operation describes that; 
Unreliable airspeed indications can result from blocking or freezing of the pitot/static system or a severely 
damaged or missing radome. When the ram air inlet to the pitot head is blocked, pressure in the probe is 
released through the drain holes and the airspeed slowly drops to zero. If the ram air inlet and the probe 
drain holes are both blocked, pressure trapped within the system reacts unpredictably. 
The pressure may increase through expansion, decrease through contraction, or remain constant. In all 
cases, the airspeed indications would be abnormal. This could mean increasing indicated airspeed in climb, 
decreasing indicated airspeed in descent, or unpredictable indicated airspeed in cruise. 
Increased reliance on automation has de-emphasized the practice of setting known pitch attitudes and 
thrust settings. However, should an airspeed unreliable incident occur, the flight crew should be familiar 
with the approximate pitch attitude and thrust setting for each phase of flight. This familiarity can be gained 
by noting the pitch attitude and thrust setting occasionally during normal flight. Any significant change in 
body attitude from the attitude normally required to maintain a particular airspeed or Mach number should 
alert the flight crew to a potential airspeed problem. 
If abnormal airspeed is recognized, immediately set the target pitch attitude and thrust setting for the 
Airplane configuration from the Airspeed Unreliable memory items. When Airplane control is established, 
accomplish the Airspeed Unreliable NNC. The crew should alert ATC if unable to maintain assigned altitude 
or if altitude indications are unreliable. 
Memory items for target pitch and thrust must be accomplished as soon as it is suspected that airspeed 
indications are incorrect. The intent of having memorized pitch and thrust settings is to quickly put the 
Airplane in a safe regime until theAirspeed Unreliable checklist can be referenced. The following 
assumptions and requirements were used in developing these memory items: 
e The memorized settings are calculated to work for all model/engine combinations, at all weights and at all 
altitudes. 
* The flaps up settings will be sufficient such that the actual airspeed remains above stick shaker and below 
overspeed. 
* The flaps extended settings will be sufficient such that the actual airspeed remains above stick shaker and 
below the flap placard limit. 
* The settings are biased toward a higher airspeed as it is better to be at a high energy state than a low 
energy state. 
* These memorized settings are to allow time to stabilize the Airplane, remain within the flight envelope 
without overspeed or stall, and then continue with reference to the checklist. 
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Settings are provided for flight with and without flaps extended. The crew should use the setting for the 
condition they are in to keep the Airplane safe while accessing the checklist. The memorized pitch and thrust 
setting for the current configuration (flapsextended/flaps up) should be applied immediately with the 
following considerations: The flaps extended pitch and thrust settings will result in a climb. The flaps up 
pitch and thrust settings will result in a slight climb at light weights and low altitudes, and a slight descent at 
heavy weights and high altitudes. 

At light weight and low altitude, the true airspeed will be higher than normal, but within the flight envelope. 
At heavy weight and high altitude, the same settings will result in airspeed lower than normal cruise but 
within the flight envelope. 

The goal of these pitch and thrust settings is to maintain the Airplane safely within the flight envelope, not to 
maintain a specific climb or level flight. The current flap position should be maintained until the memory 
pitch and thrust settings have been set and the Airplane stabilized. If further flap extension/flap retraction is 
required refer to PI-QRH Airspeed Unreliable table. 

In order to determine if a reliable source of indicated airspeed is available, the Airspeed Unreliable checklist 
says "When in trim and stabilized, cross check the captain, first officer and standby airspeed indicators." The 
intent of this statement is for the pilot flying to set the pitch attitude and thrust setting from the PI-QRH 
Flight with Unreliable Airspeed table and allow the Airplane to stabilize before comparing the airspeed 
indications to those shown in the table. 

The Airplane is considered stabilized when the thrust and pitch have been set, and the pitch is trimmed with 
no further trim movement needed to maintain the pitch setting. This is not an instantaneous process, and 
must be complete before comparing indicated and expected airspeeds for accurate results. 

If itis determined that none of the airspeed indicators are reliable, the PI-QRH tables should be used for the 
remainder of the flight. Flight crews need to ensure they are using the table and values appropriate for 
phase of flight and Airplane configuration. 

* When changing phase of flight or Airplane configuration, make initial thrust change, set pitch attitude, 
configure the Airplane as needed, then recheck thrust and pitch, and trim as needed. Do not change 
configuration until the Airplane is trimmed and stabilized at the current configuration. 

If the flight crew is aware of the problem, flight without the benefit of valid airspeed information can be 
safely conducted and should present little difficulty. 

Early recognition of erroneous airspeed indications requires familiarity with the interrelationship of 
attitude, thrust setting, and airspeed. A delay in recognition could result in loss of Airplane control. Ground 
speed information is available from the FMC and on the instrument displays. These indications can be used 
as a crosscheck. Many air traffic control radars can also measure ground speed. 


163 


Aircraft Accident Investigation Report B737- МАХ 8, ET-AVJ December 2022 


For Airplanes equipped with an Angle of Attack (AOA) indicator, maintain the analog needle at 
approximately the three o'clock position. This approximates a safe maneuver speed or approach speed for 
the existing Airplane configuration 


1.17.8 Quick Reference Handbook (QRH) 


The Ethiopian 737 Flight Crew Operations Manual, Checklist instructions, Chapter NC Section 2, dated 
February 21, 2019, stated in part, the following: 

The non-normal checklists chapter contains checklists used by the flight crew to manage non-normal 
situation. 

Most checklists correspond to a light, alert or other indication. In most cases, the MASTER CAUTION and 
system annunciator lights also illuminate to indicate the non-normal conditions. 


АП checklists have condition statements. The condition statement briefly describes the situation that caused 
the light, alert or other indication. Un-annunciated checklists also have condition statements to help in 
understanding the reason for the checklists. 

Some checklists have objective statements. The objective statement briefly describes the expected result of 
doing the checklist or briefly describes the reason for steps in the check list. 

Check lists can have both memory and reference items. Memory items are critical steps that must be done 
before reading the checklist. The last memory item is followed by a dashed horizontal line. Reference items 
are actions to be done while reading the checklist. 

Some checklists have additional information at the end of the checklist. The additional information provides 
data the crew may wish to consider. The additional information does not need to be read. 

Checklists that need a quick response are listed in the Quick Action Index which is also available on the QRH 
cover page. In each system section, Quick Action Index checklists are listed first, followed by checklists that 
are not in the Quick Action Index. The titles of Quick Action Index checklists are printed in bold type. 
Checklist titles in upper case (such as AUTO BRAKE DISARM) are annunciated by a light, alert, or other 
indication. Checklist titles in upper and lower case (such as Window Damage) are not annunciated. 


Non-Normal Situation Guideline 


When a non-normal situation occurs, the following guidelines apply: 

“ Non-normal recognition: The crewmember recognizing the malfunction calls it out clearly and precisely 

е maintain Airplane control: It is mandatory that the Pilot Flying (PF) fly the Airplane while the Pilot 
Monitoring (PM) accomplishes the NNC. Maximum use of the auto flight system is recommended to reduce 
crew workload 
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е analyze the situation: NNCs should be accomplished only after the malfunctioning system has been 
positively identified. Review all caution and warning lights to positively identify the malfunctioning 
system(s). 

«ТаКе the proper action: Although some in-flight non-normal situations require immediate corrective action, 
difficulties can be compounded by the rate the PF issues commands and the speed of execution by the PM. 
Commands must be clear and concise, allowing time for acknowledgment of each command prior to issuing 
further commands. The PF must exercise positive control by allowing time for acknowledgment and 
execution. The other crewmembers must be certain their reports to the PF are clear and concise, neither 
exaggerating nor understating the nature of the non-normal situation. This eliminates confusion and 
ensures efficient, effective, and expeditious handling of the non-normal situation 

«Evaluate the need to land: If the NNC directs the crew to plan to land at the nearest suitable airport, or if the 
situation is so identified in the QRH section СІ.2, (Checklist Instructions, and Non-Normal Checklists), 
diversion to the nearest airport where a safe landing can be accomplished is required. If the NNC or the 
Checklist Instructions do not direct landing at the nearest suitable airport, the pilot must determine if 
continued flight to destination may compromise safety. 


Non-Normal Checklist Operation 


Non-normal checklists start with steps to correct the situation. If needed, information for planning the rest 
of the flight is included. When special items are needed to configure the Airplane for landing, the items are 
included in the Deferred Items section of the checklist. Flight patterns for some engine-out situations are 
located in the Maneuvers chapter and show the sequence of configuration changes. 
While every attempt is made to supply needed non-normal checklists, it is not possible to develop checklists 
for all conceivable situations. In some smoke, fire or fumes situations, the flight crew may need to move 
between the Smoke, Fire or Fumes checklist and the Smoke or Fumes Removal checklist. In some multiple 
failure situations, the flight crew may need to combine the elements of more than one checklist. In all 
situations, the captain must assess the situation and use good judgment to determine the safest course of 
action. 
It should be noted that, in determining the safest course of action, troubleshooting, i.e., taking steps beyond 
published non-normal checklist steps, may cause further loss of system function or system failure. 
Troubleshooting should only be considered when completion of the published non-normal checklist results 
in an unacceptable situation. 
These situations include, but are not limited to, conditions where: 

ethe non-normal checklist includes the item "Plan to land at the nearest suitable airport." 


e fire or smoke continues 
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* only one AC power source remains (engine or APU generator) 
е only one hydraulic system remains (the standby system is considered a hydraulic system) 


е any other situation determined by the flight crew to have a significant adverse effect on safety if the 
flight is continued. 

Non-normal checklists also assume: 

* During engine start and before takeoff, the associated non-normal checklist is done if a non-normal 

situation is identified. After completion of the checklist, the Dispatch Deviations Guide or operator 

equivalent is consulted to determine if Minimum Equipment List dispatch relief is available. 


е System controls are in the normal configuration for the phase of flight before the start of the non- 
normal checklist. 


e If the MASTER CAUTION and system annunciator lights illuminate, all related amber lights are 
reviewed to assist in recognizing the cause(s) of the alert. 


* Aural alerts are silenced and the master caution system is reset by the flight crew as soon as the cause 
of the alert is recognized. 


e Indicator lights are tested to verify suspected faults. 


* [n flight, reset of a tripped circuit breaker is not recommended. However, a tripped circuit breaker may 
be reset once, after a short cooling period (approximately 2 minutes), if in the judgment of the captain, 
the situation resulting from the circuit breaker trip has a significant adverse effect on safety. On the 
ground, flight crew reset of a tripped circuit breaker should only be done after maintenance has 
determined that it is safe to reset the circuit breaker. 


* Flight crew cycling (pulling and resetting) of a circuit breaker to clear a non-normal condition is not 
recommended, unless directed by a non-normal checklist. 


Non-Normal Checklist Use 


Non-normal checklist use starts when the Airplane flight path and configuration are correctly established. 
Only a few situations need an immediate response (such as CABIN ALTITUDE WARNING or Rapid 
Depressurization). Usually, time is available to assess the situation before corrective action is started. АП 
actions must then be coordinated under the captain's supervision and done in a deliberate, systematic 
manner. Flight path control must never be compromised. 
When a non-normal situation occurs, at the direction of the pilot flying, both crewmembers do all memory 
items in their areas of responsibility without delay. The pilot flying calls for the checklist when: 

e the flight path is under control 

* the Airplane is not in a critical phase of flight (such as takeoff or landing) 

166 


Aircraft Accident Investigation Report B737- МАХ 8, ET-AVJ December 2022 


• all memory items are complete. 
The pilot monitoring reads aloud: 
e the checklist title 


«the Airplane effectively (if applicable) as needed to verify the correct checklist 
е as much of the condition statement as needed to verify that the correct checklist has been selected 


е as much ofthe objective statement (if applicable) as needed to understand the expected result of doing 

the checklist. 
The pilot flying does not need to repeat this information but must acKnowledge that the information was 
heard and understood. 
For checklists with memory items, the pilot monitoring first verifies that each memory item has been done. 
The checklist is normally read aloud during this verification. The pilot flying does not need to respond 
except for items that are not in agreement with the checklist. The item numbers do not need to be read... 
Non-memory items are called reference items. The pilot monitoring reads aloud the reference items, 
including: 

• the precaution (if any) 


e the response or action 


e any amplifying information. 
The pilot flying does not need to repeat this information but must acknowledge that the information was 
heard and understood. The item numbers do not need to be read. 
With the Airplane in flight or in motion on the ground the pilot flying and the pilot monitoring take action 
based on each crewmember’s Areas of Responsibility. After moving the control, the crewmember taking the 
action also states the checklist response. 
The pilot flying may also direct reference checklists to be done by memory if no hazard is created by such 
action, or if the situation does not allow reference to the checklist. 
Each checklist has a checklist complete symbol at the end. The following symbol indicates that the checklist 
is complete: 
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After completion of each non-normal checklist, the pilot monitoring states" | CHECKLIST COMPLETE. 


D6-27370-MAX-ETH QA.Index.1 February 21, 2019 Revision 2 
| 
737 Flight Crew Operation: Mansal 


737 


Quick Reference Handbook 


Quick Action Index 


APU FIRE ——————————À 8.1 
CABIN ALTITUDE WARNMING.......... 2.1 


Emergency Descendt........................0.1 


ENGINE ҒІНЕ................................................. 8.2 
Engine Limit or Surge or Stall ...................-.- 7.2 
ENGINE OVERHEAT ....................................... 8.5 
Engine Severe Damage or Separation .......... 8.2 
Engine Tailpipe Fire ..................................... 8.6 
Evacuation ..................... Back Cover.2 
LANDING COMFIGURJATIGQOIM.........-. 4n 15.1 
Loss Of Thrust On Both Engines ................-.- 7.5 
Rapid Depressurization ................. 2.1 
Runaway Stabilizer ...................................... 9.1 
Smoke, Fire or Fumes ci ta i pa ali 
TAKEOFF CONFIGURATION. ........................ 15.1 
WARNING HORN (INTERMITTENT) ............ 15.2 
WARNING LIGHT - CABIN ALTITUDE OR 
TAKEOFF CORMFIGURATIGOM.........----- 15.2 
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Runaway Stabilizer 


Condition: Uncommanded stabilizer trim movement 
occurs continuously. 


1 Control соїитп................. Hold firmly 
2 Autopilot (if engaged)............. Disengage 
Do not re-engage the autopilot. 


Control airplane pitch attitude manually with 
control column and main electric trim as 
needed. 


CJ 


Autothrottle (if engaged)........... Disengage 
Do not re-engage the autothrottle. 


м 


If the runaway stops after the autopilot is 
disengaged: 
BEEN 


Ul 


If the runaway continues after the autopilot is 
disengaged: 


STAB TRIM CUTOUT 
switches (both) ................ CUTOUT 


If the runaway continues: 
Stabilizer 
trim wheel .......... Grasp and hold 
6 Сбїай!гег................... Trim manually 
7 Anticipate trim requirements. 
8 Checklist Complete Except Deferred Items 


Y Continued on next paqe Y 
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T Fig Cren бүлін іші 


[A5 DISAGREE 
Conditor: The IAS DISAGREE alert indicates the 
captain s and first officer's airspeed 
indications disagree, 
PP Go to the Airspeed Unreliable checklist on 
page 10.1 
TE 
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737 | PP Er RN Малпа] 


Airspeed Unreliable 


Cendition: Airspeed or Mach indications are suspected 
to be unreliable. (Items which might indicate 
unreliable airspeed are listed іп the 
Additional Information section.) 


Objective: To identify a reliable airspeed indication, if 
possible, or to continue the flight using the 
Flight With Unreliable Airspeed table in the 
Performance Inflight chapter. 


1 Autopilot (if engaged).............Disengage 
2 Aubtethrottle (if engaged). ..........Пнзепдаде 
3 F/D switches (both) .................. OFF 
4 Set the following gear up pitch attitude and thrust: 

Flaps extended .......... 10° and 8095 M1 

Flaps up "P 4.4... 4% and 759% М1 
5 PROBE HEAT switches............ , Check ON 
& The following are reliable: 

Attitude 

Ni 

Ground speed 

Radio altitude 


Note: Stick shaker, owerspeed warning and 
AIRSPEED LOW alerts may sound 
erroneously or simultaneously. 

Note: The Flight Path Vector and Pitch Limit 
Indicator may be unreliable. 


7 Refer to the Flight With Unreliable Airspeed table in 
the Performance Inflight chapter and set the pitch 
attitude and thrust setting for the current airplane 
configuration and phase of flight. 


* Continued on next page А 


171 


Aircraft Accident Investigation Report B737- MAX 8, ET-AVJ December 2022 


8 When in trim -- stabilized, cross check the 
captain, first officer and standby airspeed 
indicators. An airspeed indication that differs by 
more than 20 knots or 0.03 Mach from the airspeed 
shown in the table should be considered 
unreliable. 

S Choose one: 

Reliable airspeed indication can be determined: 
Use the most reliable airspeed source for 
the remainder of the flight. 

b» Goto step 10 
Reliable airspeed indication can not be 


determined: 
Со to step 14 


10 Choose one: 


Captain's or First Officer's airspeed indication 
is reliable: 


>» Go to step 11 
Only the standby airspeed indication is 


reliable: 
Note: Do not use the autopilot, 
autothrottle, or flight directors. 
Do not use TO/GA for a go-around 
or missed approach. 
> Go to step 17 
11 Flight director switch (reliable side) ........ ON 
12 Autopilot (reliable сіде).............. Engage 
13 ALT selector 
о. onc aa RR Rd (1 or 2) Select reliable side 


Note: Do not use the autothrottle. 


>> Goto step 17 

|4 Set pitch attitude and thrust from the Flight With 
Unreliable Airspeed table in the Performance 
Inflight chapter for the airplane configuration and 
phase of fliaht. as needed. 
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ж Дігеренмі Unnellaibla continued Y 


& When іп trim and stabilized, cross check the 
captain, first officer and standby airspeed 
indicators. An airspeed indication that differs by 
more than 20 knots or 0.03 Mach from the airspeed 
shown in the table should be considered 
unreliable. 


9 Choose one: 

Reliable airspeed indication can be determined: 
Use the most reliable airspeed source for 
the remainder af the flight. 
b Соо to step 10 

Reliable airspeed indication can mot be 

determined: 

FF Go to step 14 


10 Choose one: 
Captain's or First Officer's airspeed indication 
is reliable: 
FF Go to step 11 


Only the standby airspeed indication іс 
reliable: 


Mote: Do not use the autopilot, 
autothrottle, or flight directors. 


Da not use TOGA for a go-around 
or missed approach. 


FF Co to step 17 


11 Flight director switch (reliable side) ........O0N 
12 Autopilot (reliable side). .............Engage 


13 ALT selector 
switch............(1 or 2) Select reliable side 


Note: Do not use the autothrottle. 
FF Go to step 17 
ha Set pitch attitude and thrust from the Flight With 
Unreliable Airspeed table in the Performance 


Inflight chapter for the airplane configuration and 
phase of fliaht. as needed. 
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 Pirgepeed Linrelabsée continued Y 
15 Check the Non-Normal Configuration Landing 
Distance table in the Advisory Information section 
of the Performance Inflight chapter. 
Mote: Maintain visual conditions if possible. 
Establish landing configuration early. 


Radio altitude reference is available below 
2,500 feet. 
Use electronic and visual glideslope 
indicators, where available, for approach and 
landing. 
Do not use the the autopilot, autothrottle, or 
flight directors. 
Do not use TOGA for a go-around or missed 
approach. 

16 Transponder mode selector .......-....-... TA 


i17 Choose one: 
Altitude іс reliable: 
Em m шш 
+ Altitude iz unreliable: 


Transponder mode 
selector .................. ALT OFF 


MES Additional Information ME 


One or more of the following may be evidence of 
unreliable airspeed or Mach indications: 


se Speed/altitude information not consistent with pitch 
attitude and thrust setting 

+ SPD failure flag 

+ SPD LIM failure flag 

*IAS DISAGREE alert 

«Бізгік or fluctuating airspeed display 

«Variation between captain and first officer airspeed 
displays 

+ Radome damage or loss 

eOverspeed warning 

+ Simultaneous overspeed and stall warnings. 
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737 ЕБ Crewr Operations Мшштыш. 


ALT DISAGREE 


Condition: The ALT DISAGREE alert indicates the 
captain's and first officer's altitude 
indications disagree by more than 200 feet. 


1 Check all altimeters are set to correct barometric 
setting for phase of flight. 


2 Choose one: 
ALT DISAGREE alert extinguishes: 
Continue normal operation. 
ш ш ш ш 
ALT DISAGREE alert stays illuminated: 
FF lho to step 3 


ы 


Airplane does not meet RVSM airspace 
requirements. 


Standby altimeter is available. 
Lc mot use the flight path vector. 
Maintain visual conditions if possible. 


som щл È 


Choose one: 
A reliable altitude can be determined: 


Transponder selector ........... Select 
reliable side 


FF iho to step & 
A reliable altitude cammot be determined: 


Transponder mode 
Seer ..................Ж.С.ҰижҰҒғ 
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ADA DISAGREE 


Condition: The ADA DISAGREE alert indicates the left 
and right angle of attack vanes disagree. 


1 Airspeed errors and the IAS DISAGREE alert may 
снаа". 


2 Altimeter errors and the ALT DISAGREE alert may 
[еш Т а 
ш ш ш ш 


Display Failure 


Condition: A display unit in the MAX display system is 
failed. 


1 Choose one: 
Outboard display unit iz failed: 
k- lo to step 2 
Inboard display unit is failed: 
k Go to step 4 
2 PFD/MFLD selector 
(affected side}... . Tet eee ee ee ee ЖЕНЕ 
3 EMG ТЕН съез ................ «= Needed 


4 ЕМЕС selector 


(affected side} . . . a s = = n u 4... NORM or OUTED 
as needed 
5 EMG TFR swibdh ............ ee ee AS needec 


Mote: The transfer of engine indications is only 
available when the PFODYMEO selector on the 
failed side is selected to САЛТЫ», 


Гына йаш: Ёге рас ыллыга Черга. Ж: Mh Cele bus eee ы- eee ee eee [0374 ee Dia рышы Fo eee 


April 19, 2015 пв-отата-маз-ғтен 10.3 
1.17.9 Safety Management System 


The operator shall develop an SMS implementation plan, formally endorsed by the organization that defines 
the organization's approach to the management of safety in a manner that meets the organization's safety 
objectives. 
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Safety Management System Standard for Airplane Operator 


ICAO Annex 19 subchapter 4 requires Airplane operator to establish Safety Management System (SMS) as 
systematic approach to manage safety and designed to continuously improve safety performance through: 
the identification of hazards, the collection and analysis of safety data and safety information, and the 
continuous assessment of safety risks. Appendix 2 of this Annex described the minimum requirement for 
SMS framework which must comprise the four components, combined with the twelve elements comprise 
the ICAO SMS framework, are as follows: 
1. Safety policy and objectives 
- Management commitment and responsibility 
- Safety accountabilities 
- Appointment of key safety personnel 
- Coordination of emergency response planning 
- SMS documentation 
2. Safety risk management 
- Hazard identification 
- Risk assessment and mitigation 
3. Safety assurance 
- Safety performance monitoring and measurement 
- The management of change 
- Continuous improvement of the SMS 
4. Safety promotion 
- Training and education 
- Safety communication 


Ethiopian SMS, REV 09.01 indicating that: 


Ethiopian operational safety reporting systems provide operational personnel with a means of proactive 
and reactive method to report safety hazards or any other safety concerns so that they may be brought to 
the attention of responsible operational managers. Data gathered from voluntary /confidential and non- 
punitive and mandatory reporting is only used to identify system vulnerabilities and develop effective 
mitigation and implementation measures to address the consequences of those threats, errors and hazards 
occurrences relevant to the aviation safety. 
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1.17.9.1 Hazard Identification as Part of Safety Risk Management 


Safety reporting system is one of the main internal sources within Airplane operator to identify hazard, 
especially a voluntary safety reporting system. Personnel at all levels and across all disciplines are 
encouraged to identify and report hazards and other safety issues through their safety reporting systems. 
Safety reporting systems should be readily accessible to all personnel. A paper-based, web-based or desktop 
form can be used depending on the situation. Having multiple entry methods available maximizes the 
likelihood of staff engagement. Everyone should be made aware of the benefits of safety reporting and what 
should be reported. 

Safety risk management requires the service provider to develop and maintain a formal process to identify 
hazards that may contribute to aviation safety-related occurrences. Hazards may exist in ongoing aviation 
activities or be inadvertently introduced into an operation whenever changes are introduced to the aviation 
system. In this case, hazard identification is an integral part of the change management processes as 
described in SMS framework element 3.2 - The management of change. 


The service provider shall develop and maintain a formal process that ensures that hazards in operations 
are identified. Hazard identification shall be based on a combination of reactive, proactive and predictive 
methods of safety data collection. 


Hazard identification is the first step of Safety Risk Management (SRM), the ICAO Annex 19 Appendix 2, 
described that Airplane operator must develop and maintain a process that ensures that hazards associated 
with flight operations are identified based on a combination of reactive, proactive and predictive methods of 
safety data collection. 

The ICAO Document 9859 provided guidelines to develop SMS within organization including Airplane 
operator. The subchapter 2.5.2.10 of the document describes two main methodologies for identifying 
hazards, as follows: 


a) Reactive, which involves analysis of past outcomes or events. Hazards are identified through investigation 
of safety occurrences. Incidents and accidents are an indication of system deficiencies and therefore can be 
used to determine which hazard(s) contributed to the event. 

b) Proactive, which involves collecting safety data of lower consequence events or process performance and 
analyzing the safety information or frequency of occurrence to determine if a hazard could lead to an 
accident or incident. The safety information for proactive hazard identification primarily comes from flight 
data analysis (FDA) programs, safety reporting systems and the safety assurance function. 


a. organizational safety policies and safety objectives; 
b. organizational roles and responsibilities related to safety; 
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c. basic SRM principles; 
d. safety reportingsystems; 
e. the organization's SMS processes and procedures; and 


f. humanfactors. 


1.17.10 FLIGHT CREW TRAINING MANUAL (FCTM) 
The Flight Crew Training Manual, Chapter 3 "Takeoff and Initial Climb" stated in part, the following: 
Rotation and Liftoff All Engines 


Takeoff speeds are established based on minimum control speed, stall speed, and tail clearance margins. 
Shorter- bodied Airplanes are normally governed by stall speed margin while longer-bodied Airplanes 
arenormally limited by tail clearance margin. When a smooth continuous rotation is initiated at VR, tail 
clearancemargin is assured because computed takeoff speeds depicted in the PI Chapter of the FCOM, 
airport analysis, orFMC, are developed to provide adequate tail clearance. 

Above 80 Kt, relax the forward control column pressure to the neutral position. For optimum takeoff 
andinitial climb performance, initiate a smooth continuous rotation at VR toward 15? of pitch attitude. 
However, takeoffs at low thrust setting (low excess energy) will result in a lower initial pitch attitude target 
to achieve the desired climb speed. 

The use of stabilizer trim during rotation is not recommended. After liftoff, use the attitude indicator, or 
indications on the PFD or HUD (HUD equipped Airplane s), as the primary pitch reference. The flight 
director, in conjunction with indicated airspeed and other flight instruments is used to maintain the proper 
vertical flight path. 

Note: The flight director pitch command is not used for rotation. 

With a consistent rotation technique, where the pilot uses approximately equal control forces and similar visual 
cues, the resultant rotation rate differs slightly depending upon Airplane body length. 

Note: Do not adjust takeoff speeds or control forces to compensate for increased body length. 


Using the technique above, resultant rotation rates vary from 2? to 3? per second with rates being lowest on 
longer Airplane s. Liftoff attitude is achieved in approximately 3 to 4 seconds depending on Airplane weight 
and thrust setting. 
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OVERSPEED 


VMO/MMO is the Airplane Maximum certified operating speed and should not be exceeded intentionally. 
However, crews can occasionally experience an inadvertent over speed. Airplane has been flight tested 
beyond VMO/MMO to ensure smooth pilot inputs will return the Airplane safely to the normal flight 
envelope. 

At high altitude, wind speed or direction changes may lead to overspeed events. Although autothrottle logic 
provides for more aggressive control of speed as theAirplane approaches VMO or MMO, there are some 
conditions that are beyond the capability of the autothrottle system to prevent short term overspeeds. 


When correcting an overspeed during cruise at high altitude, avoid reducing thrust to idle which results in 
slow engine acceleration back to cruise thrust and may result in over-controlling the airspeed or a loss of 
altitude. If autothrottle corrections are not satisfactory, leave the autopilot engaged; deploy 
partialSpeedbrakes slowly until a noticeable reduction in airspeed is achieved. When the airspeed is below 
VMO/MMO, retract the speedbrakes at the same rate as they were deployed. The thrust levers can be 
expected to advance slowly to achieve cruise airspeed; if not, they should be pushed up more rapidly. 


When encountering an inadvertent overspeed condition, crews should leave theautopilot engaged and use 
the speedbrakes as needed unless it is apparent that theautopilot is not correcting the overspeed. However, 
if manual inputs are required, disengage the autopilot. Be aware that disengaging the autopilot to avoid or 
reducethe severity of an inadvertent overspeed may result in an abrupt pitch change. 


Initiating Takeoff Roll 


Auto throttle and flight director use is recommended for all takeoffs. However, do not follow FD commands 
until after liftoff. 


A rolling takeoff is recommended for setting takeoff thrust. It expedites the takeoff and reduces the risk of 
foreign object damage or engine surge/stall due to a tail wind or cross wind. Flight test and analysis prove 
that the change in takeoff roll distance due to the rolling takeoff is negligible when compared to a standing 
takeoff. 
Rolling takeoffs are accomplished in two ways: 

• if cleared for takeoff before or while entering the runway, maintain normal taxi speed. 
When the Airplane is aligned with the runway centerline ensure the nose wheel steering wheel is released 
and apply takeoff thrust by advancing the thrust levers to just above idle (4096N1). 
Allow the engines to stabilize momentarily then promptly advance the thrust levers to takeoff thrust (auto 
throttle TO/GA). There is no need to stop the Airplane before increasing thrust. 
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e if holding in position on the runway, ensure the nose wheel steering wheel is released, release brakes, 
then apply takeoff thrust as described above. 


Rotation and Liftoff - АП Engines 


Takeoff speeds are established based on minimum control speed, stall speed, and tail clearance margins. 
Shorter-bodied Airplane is normally governed by stall speed margin while longer-bodied Airplanes 
arenormally limited by tail clearance margin. When a smooth continuous rotation is initiated at VR, tail 
clearancemargin is assured because computed takeoff speeds depicted in the PI Chapter of the FCOM, 
airport analysis, ог ЕМС, are developed to provide adequate tail clearance.Above 80Kt, relax the forward 
control column pressure to the neutral position. For optimum takeoff and initial climb performance; initiate 
a smooth continuous rotation at VR toward 15? of pitch attitude. However, takeoffs at low thrust setting 
(low excess energy) will result in a lower initial pitch attitude target to achieve the desired climb speed. 

The use of stabilizer trim during rotation is not recommended. After liftoff, use the attitude indicator, or 
indications on the PFD or HUD (HUD equipped Airplane s), as the primary pitch reference. The flight 
director, in conjunction with indicated airspeed and other flight instruments is used to maintain the proper 
vertical flight path. 


1.17.11 TRAINING AND EDUCATION AS PART OF SAFETY PROMOTION 


According to ICAO Annex 19 Appendix2, Airplane operator must develop and maintain safety training 
program which ensures personnel are trained and competent to perform their SMS duties. The ICAO 
Document 9859 subchapter 9.6.4 described personnel who are trained and competent to perform their SMS 
duties, regardless of their level in the organization, is an indication of management's commitment to an 
effective SMS. The provision of training to appropriate staff, regardless of their level in the organization, is 
an indication of management's commitment to an effective SMS. Safety training and education curricula 
should consist of the following: 
a. Organizational safety policies, goals & objectives; 


b. Organizational safety roles and responsibilities related to safety; 
c. Basic safety risk management principles; 

d. Safety reporting systems; 

e. Safety management support; 

f. Lines of communication for dissemination of safety information; 

g. A validation process that measures the effectiveness of training; 


h. Recurrent training requirements; 
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1.17.11.1 Flight Crew Records 


a) The flight crew certifications, qualifications, training and currency requirements shall be recorded and 
retained at the training department. The crew scheduling shall ensure that each flight crew member 
prior to being assigned to duty, are qualified and current in accordance with the below listed items, and 
the flight crew members shall not accept a flight if not qualified for duty in accordance with the 
requirements as listed below. 

е  Licenses/certification (entire period of employment); 


e Specific qualification (LVP, RVSM, EDTO etc.); 

е Equipment qualification (TCAS/ACAS, GPWS/EGPWS); 

е Initial training, route training, route check, recurrent training, Proficiency check, line check and 
checking results; 

е Type(s) of qualification (entire period of employment); 

е CRM/Human Factor training; 

е DangerousGoods training; 

b) The training record copies sent to Ethiopian Civil Aviation Authority shall be used as the back up until 

the digitalized soft record maintenance project is completed. 

C) It is the responsibility of Training Department and Manager Crew Scheduling to maintain and control 

records of: 

Type(s) of qualification 

e Recency of experience 

e Medical status 

e Right seat qualification 

e Airport and route competence 

e Instructor/Examiner/ Check Airman qualification 

e Flight time, duty time and rest time 

d) Manager Crew Scheduling shall ensure that there is a due date alert system to be utilized by each 

Scheduler before scheduling any crew member for a flight duty especially when dual qualification 

applies for a particular flight crew member. He shall also, in close cooperation with each respective Chief 

Pilot, plan the renewal of all re- currency requirements. 


e) Flight Operations shall ensure that at least the following records are kept for 18 months for each flight 
crew member: (ECARAS 8.12.1.15) 
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* Тһе start, duration and end of each flight duty period 

e Rest periods 

e Flight time 

f) The data in the Crew Management System (CMS) as well as the backup digital file in the Information 
Service department shall serve as the overall back up for these files. 


The ADs, Bulletins and MOMs were released through the logipad system which the pilots are required to 
upload as a standard procedure before going for flight. The company has got a checking system who did and 
who didn't. Pilots are required to update their digital updated charts and performance data by their 
LOGIPAD and this was done at least every 7 days. 


During initial and proficiency training, crew used to take the stick shaker activation, IAS Disagree, 
Stabilizer Runaway, use of trim wheel, reaction to multiple non-normal, task prioritize and CRM training. In 
the proficiency check the crew has taken training using a simulator and found satisfactory. These trainings 
were incorporated in FCTM, AMP, QRH, and FOTPM. 


1.17.11.2 Flight Crew Training Programme 


ECARAS part 8 article 8.10.1.9 specifies that an operator shall establish and maintain ground and flight 
training program, approved by the authority which insures that all flight crew members are adequately 
trained to perform their assigned duties. The operator shall receive written approval from the Authority 
before that revision can be used. The training program shall: 


1. Include ground and flight training facilities and properly qualified instructors as determined by the 
Authority; 

2. Consist of ground and flight training for the type(s) of Airplane on which the flight crew member serves; 

3. include proper flight crew coordination and training for all types of emergency and abnormal situations or 
procedures caused by engine, transmission, rotor, airframe or systems malfunctions, fire or other 
abnormalities; 

4. include training in Knowledge and skills related to the visual and instrument flight procedures for the 
intended area of operation, human performance and threat and error management, the transport of 
dangerous goods and, where applicable, procedures specific to the environment in which the Airplane is to 
be operated; 

5. Ensure that all flight crew members know the functions for which they are responsible and the relation of 
these functions to the functions of other crew members, particularly in regard to abnormal or emergency 
procedures; 
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6. shall include Knowledge and skills related to the operational use of head-up display and/or enhanced 
vision systems for those Airplane so equipped; and 

7. Be given on a recurrent basis, as determined by the State of the Operator and shall include an examination 
to determine competence. 


TRAINING PROGRAM APPROVAL 


a. Each AOC holder shall ensure that all operations personnel are properly instructed in their duties and 
responsibilities and the relationship of such duties to the operation as a whole. 

b. Each AOC holder shall have a training program manual approved by the Authority containing the general 
training, checking, and record keeping policies. 

c. Each AOC holder shall have approval of the Authority prior to using a training curriculum for the purpose 
of qualifying a crewmember, or person performing operational control functions, for duties in commercial 
air transport. 

d. Each AOC holder shall submit to the Authority any revision to an approved training program, and shall 
receive written approval from the Authority before that revision can be used. 


1.17.12 TYPE RATING RECURRENT TRAINING AND CHECKING 
1.17.12.1 Type Ratings 


ECARASpart two articles 2.3.2.4 states that: 
a. The type rating shall be endorsed on the license as a rating, including any limitations. 
b. A pilot seeking an Airplane type rating to be added on a pilot license shall: 
1. Hold or concurrently obtain an instrument rating that is appropriate to the Airplane category, classor 
type rating sought; 
2. Have an endorsement in his or her logbook or training record from an authorized instructor that the 
applicant has gained, under appropriate supervision, experience in the applicable type of Airplane and/or 
flight simulator in the following: 
i. Normal flight procedures and maneuvers during all phases of flight 
ii. Abnormal and emergency procedures and maneuvers in the event of failures and malfunctions of 
equipment, such as power plant, systems and airframe; 
iii. Where applicable, instrument procedures, including instrument approach, missed approach and 
landing procedures under normal, abnormal and emergency conditions,including simulated engine 
failure; 
iv. Procedures for crew incapacitation and crew coordination including allocation of pilot tasks; crew 
cooperation and use of checklists; 
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3. Pass the required skill test at the ATPL level, applying crew resource management concepts, applicable to 
the Airplane category, class and type rating being sought; 
LApplicants seeking a private or commercial license in an Airplane that requires a type ratingshall also 
completes the applicable portions of either the PPL or CPL skill test inconjunction with the ATPL skill 
test. 
4. Perform the skill test under instrument flight rules unless the Airplane used for the skill test is not capable 
of the instrument maneuvers and procedures required for the skill test in which case the applicant may: 
i. Obtain a type rating limited to "VFR only," and 
ii. Remove the "VFR only" limitation for each Airplane type in which the applicant demonstrates 
compliance with the ATPL skill test under instrument conditions. 
c. Privileges. Subject to compliance with the requirements specified in this Part, the privileges of the 
holder of a type rating are to act as a pilot on the type of Airplane specified in the rating. When a type 
rating is issued limiting the privileges to act as co-pilot or limiting the privileges to act as pilot only 
during the cruise phase of flight, such limitation shall be endorsed on the rating. 
d. Validity: Subject to compliance with the requirements in this Part, the validity period of a type rating 
is1 calendar year. 
e. Renewal. For the renewal of a type rating, the pilot shall: 
1. Within the three months immediately preceding the expire date, complete a proficiency check: in the 
areas of operation listed in the skill test for the appropriate category, type and if applicable class of Airplane; 
2. Have completed 10 route sectors within the 3 months preceding the expiry date; and 
3. If a pilot takes the proficiency check required in this section in the calendar month before or the calendar 
month after the month in which it is due, the pilot is considered to have taken it in the month in which it was 
due for the purpose of computing when the next proficiency check is due. 
f. Re-issue. If the type rating has been expired the applicant shall: 
1. Have received refresher training from an authorized instructor with an endorsement that the person is 
prepared for the required skill test; and 
2. Pass the required skill test for the appropriate category, type and if applicable class of Airplane. 


1.17.12.2 Recurrent Training 


a. Each AOC holder shall establish a recurrent training programfor all flight crew members inthe AOC 
holder's Operations Manual and shall have it approved by the Authority. 

b. Each flight crew member shall undergo recurrent training relevant to the type or variant of Airplane on 
which he or she is certified to operate and for the crew member position involved. 

c. Each AOC holder shall have all recurrent training conducted by suitably qualified personnel. 
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d. Each AOC holder shall ensure that flight crew member recurrent ground training includes CRM, Airplane 
systems and limitations, takeoff and landing, dangerous goods, etc. 
a. Crew resource management: 
1. Decision-making skills 
2. Briefings and developing open communication. 
3. Inquiry, advocacy, and assertion training. 
4. Workload management 
5. Situational awareness 
The operator has got training manual which is approved by Ethiopian Civil Aviation Authority. According to 
this manual the accident pilot and first officer has taken the type rating, recurrent training, the line check 
and proficiency check as it is clearly put in the Ethiopian civil aviation Rules and standards(ECARAS) Part 
2,part 8 and part 9 and the operation training manual of the company. 


Ethiopian Civil Aviation Authority based on ICAO Doc 8335, Manuals of procedures for operation inspection, 
Certification and continued surveillance conducts an oversight of the operator using inspector procedure 
hand book and audit policy manual for the compliance of ECARAS part 2, part 8 and part 9. Ref Operation 
Inspector Handbook chapter 1-06 Annual Inspection Program, chapter 4-08 training program Inspections, 
chapter 4-07 Training and Qualification Record inspection 


On the accident Airplane PF simulator proficiency check was conducted on October 1, 2018 and line check 
was also performed on 30 November 2018; the FO last proficiency check was December 3, 2018. 


Flight Operations Accident Crew Trainings 


TABLE24: PF & FO PROFICIENCY TRAINING 


Captain Type of Training check Date 
Stick shaker activation 01.04.2018 
IAS Disagree 30.09.2018 
Runaway Stabilizer 21.10.2017 
Use of Trim wheel 21.10.2018 
Reaction to multiple non-normal 03.12.2018 
Task prioritization 17.11.2018 
MOM 15.11.2018 
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TABLE 25: FO PROFICIENCY TRAINING 


First officer | Type of Training check Date 
Stick shaker activation 03.12.2018 
IAS Disagree 08.12.2018 
Runaway Stabilizer 28.11.2018 
Use of Trim wheel 28.11.2018 
Reaction to multiple non-normal 01.04.2018 
Task prioritization 10.12.2018 
MOM 15.11.2018 


Flight operations revise the seasonal recurrent training/check syllabus to include RUNAWAY STABILIZER 
Non-normal procedure practice and ensured that all crew members have received the AD and OMB by 
uploading them on Logipad. Furthermore, the documents were also sent to each B737 flight crew by email. 


1.17.12.3 ECAA Action Upon Receipt of the FAA'S AD 


Monitoring Airworthiness Directives Compliance (ECAA CHAPTER 2-60): 


All Airplanes that operate in Ethiopia were manufactured and/or certificated in another State. In order to 
continue to maintain such Airplane (registered in Ethiopia) at a level of airworthiness equivalent to that 
achieved in the State in which the Type certificate for the Airplane was issued, the ECAA will obtain all 
airworthiness directives, service bulletins, etc, issued by the type certification authority, by the 
manufacturer or, by the airworthiness authority of any other State in which the same type of Airplane are 
registered, where such information pertains to the continuing airworthiness and the prevention and 
remedying of recurring defects in Airplane and their equipment. 


Upon registration of an Airplane in Ethiopia, the Authority will notify the State of Design of the Airplane of 
the registration in Ethiopia, and request that the Authority receives any and all airworthiness directives 
addressing that Airplane, airframe, Airplane engine, propeller, appliance, or component part and any 
requirements for the establishment of specific continuing airworthiness programs. 

ECARAS 5.5.1.2 (d) states that the Authority may issue Airworthiness Directives when it determines that an 
airframe or aeronautical product has exhibited an unsafe condition and this condition is likely to exist or to 
develop in other products of the same type design. However, until such time that an appropriate engineering 
division is established, the Authority will not develop its Airworthiness Directives. 

With this consideration whenever the State of Design considers that a condition in an Airplane , airframe, 
Airplane engine, propeller, appliance, or component part is unsafe as shown by the issuance of an 
airworthiness directive by that State, such directive shall apply to Ethiopian registered civil Airplanes of the 
type identified in that airworthiness directive". In general, Airworthiness Directives issued by FAA, EASA or 
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both are automatically applicable to all Ethiopian registered Airplanes. 


Airworthiness Directives issued by the State of Manufacture/Design of the Airplane are mandatory for 
Ethiopia registered Airplane. Ethiopia does not issue its own Airworthiness Directives. No person may 
operate any Ethiopia registered civil Airplane to which the measures of ECARAS 5.4.1.10 apply, except in 
accordance with the applicable airworthiness directives and service bulletins. 


1.17.13 Federal Aviation Administration (FAA) Airplane Certification 


The Federal Aviation Administration (FAA) is responsible for prescribing minimum standards required in 
the interest of safety for the design, material, construction, quality of work, and performance of the Airplane, 
Airplane engines, and propellers (Ref. 49USC44701). Product certification is a regulatory process 
administered by the FAA to ensure that an Airplane manufacturer's product conforms with Federal Aviation 
Regulations (FAR). Successful completion of the certification process enables the FAA to issue a Type 
Certificate (TC) or an Amended Type Certificate. To obtain a TC or an Amended Type Certificate, the 
manufacturer must demonstrate to the FAA that the Airplane or product being submitted for approval 
complies with all applicable regulations. The FAA determines whether or not the applicant has met its 
responsibility to show compliance to the applicable regulations. 

The Federal regulations that apply to type certification of transport-category Airplanes are 14 CFR Part 21, 
25, 26, 33, 34, and 36. The Part 25 regulations are those concerned with the airworthiness standards for 
transport-category Airplanes and are organized into sub parts A through G. These regulations represent the 
minimum standards for airworthiness; an applicant's design may exceed these standards and the applicant's 
tests and analyses may be more extensive than required by regulation. The specific applicable regulatory 
requirements and how compliance will be demonstrated is documented in an FAA approved certification 
plan. 


CERTIFICATION GUIDANCE 


FAA Order 8110.4C, titled "Type Certification", prescribes the responsibilities and procedures the FAA must 
follow to certify new civil Airplane, Airplane engines, and propellers, or changes thereto, as required by 14 
of the CFR Part 21. This order is primarily written for internal use by the FAA, its designees, and delegated 
organizations. The order provides procedures and policy for the type certification of products and, unless 
stated otherwise, the type certification process in this order applies to all U.S. TCs, including amended TCs 
and Supplement Type Certificate (STCs). 
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1.17.13.1 Type Certification Process 


FAA Order 8110.4C contains section that presents a high-level flow diagram of the certification events that 
typically make up the life cycle an Airplane. The diagram is meant to explain the type certification process, 
not to dictate precisely how the project should flow. Although the model shows the proper sequence of 
events for certificating a product, the various aspects of the project generally progress through the process 
at different times and at different rates. The model divides the product's type certification life cycle into 
phases based on the FAA and Industry Guide to Product Certification. For each of the certification events 
identified on the flow diagram, the Order also provides information describing each event 
identifiesexpectations and develops specific interface procedures between the applicant and the FAA. 

During a meeting with the NTSB, the FAA provided a high-level overview of the certification process for an 
amended type design program. The listed documents indicate detail changes to be presented for FAA 
certification as compared to type certificated baseline airplanea Certification Project Notification (CPN), a 
Program Notification Letter (PNL) and a Master Certification Plan (MCP). These documents detail the 
changes and identify the regulatory requirements and policies that are applicable; they also identify areas of 
change associated with the FAA airworthiness directives. As part of the overview, the FAA provided a high- 
level flow diagram of the certification events that contained similar information as the diagram within Order 
8110.4c. The following figure shows the FAA certification process. 
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FIGURE 90: DIAGRAM OF FAA CERTIFICATION PROCESS 


1.17.13.2 FAA Certification Office 


The FAA has 10 Airplane Certification Offices (ACO) which are responsible for approving the design 
certification of Airplane, Airplane engines, propellers, and replacement parts for those products. There are 
also specialized certification offices which include the Engine Certification Office (ECO), the Military 
Certification Office (MCO), the Boeing Aviation Safety Oversight Office (BASOO), and the Delegation Systems 
Certification Office (DSCO). FAA's BASOO responsibilities include oversight of Boeing's Organization 
Designation Authorization (ODA), involvement in certification of safety critical areas as well as novel and 
unusual designs and assisting foreign Civil Aviation Authorities (CAAs) in validation of Boeing products. The 
BASOO was responsible for the certification oversight and approval for the Boeing 737-8 (MAX). 
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CERTIFICATION BASIS 


According to Type Certificate Data Sheet?? (TCDS) A16WE, revision 64, dated October 10, 2018, Boeing 
applied for a transport category amended type certificate (ATC) for the 737-8 Airplane on June 30, 2012. 
The ATC was approved on March 8, 2017. The Boeing 737-8 Airplane was added as the most recent model 
in a series of derivative models (or "changed aeronauticalproducts") that were approved and added to the 
Boeing type certificate (TC), originally issued for the Boeing 737-100 on December 15, 1967. 


The applicable certification basis for the 737-8 Airplane is Title 14, Code of Federal Regulations (14 CFR) 
part 25 as amended by Amendments 25-0 through 25-137, plus amendment 25-141 with exceptions 
permitted by 14 CFR 21.101. 


These security features must be in consideration in any subsequent type design change, modification, or 
repair to ensure the level of safety designed into the Boeing 737-8 (MAX) and 737-9 is maintained. 


1.17.13.3 Certification Basis for Changed Aviation Products 


The certification basis for changed aeronautical products allows an Airplane manufacturer to introduce a 
derivative model as a design update on a previously certificated Airplane and add the changed product onto 
an existing TC. The FAA approves such changes if it finds that the changes are not significant enough to 
warrant application for a new TC. This process enables a manufacturer to introduce derivative Airplane 
models without having to resubmit the entire Airplane design for certification review. The manufacturer can 
use the results of some of the analyses and testing from the original type certification to demonstrate 
compliance, in which case the regulations that were in effect on the date of the original TC apply. 

Title 14 CFR 21.101, Subpart D, specifies the requirements for demonstrating airworthiness compliance for 
changed aeronautical products. The current revision of 14 CFR 21.101, amendment 21.92, which became 
effective on April 16, 2011, states that an application for a changed aeronautical product to be added to a TC 
"must show that the changed product complies with the airworthiness requirements applicable to the 
category of the product in effect on the date of the application." This regulation is more specific than 
previous revisions regarding what can be used from the original certification basis in an application for a 
derivative model involving a major change. 


22A Type Certificate Data Sheet (TCDS) is a formal description of the Aircraft, engine or propeller. It lists limitations and information 
required for type certification including airspeed limits, weight limits, thrust limitations, etc. 
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On April 25, 2003, the FAA issued FAA Order 8110.48, How to Establish the Certification Basis for Changed 
Aeronautical Products, which provides the procedures that the FAA utilize for determining the certification 
basis for changes to type certificated products including changes made through an amended Type Certificate 
which is the method utilized for the G-IV. The handbook refers to FAA Advisory Circular 21.101-1, 
establishing the Certification Basis of Changed Aeronautical Products, which contains an acceptable means, 
but not the only means, to comply with 14 CFR 21.101. On July 21, 2107, this Order 8110.48 was cancelled 
and replaced by Order 8110.48А. 


1.17.13.4 System Safety Assessment Process 


The process for developing and certifying a safety-critical system must provide assurance that all significant 
single failure conditions have been identified and that all combinations of failures which lead to hazardous 
or catastrophic Airplane level effects have been considered and appropriately mitigated. Airplane 
manufacturers provide this assurance through their safety assessment processes. 


The safety assessment process is divided into two parts; the Airplane level safety assessment and the 
individual system safety assessments. The Airplane safety assessment assures the robustness of the overall 
Airplane system design that implements the required Airplane functions.The individual system safety 
assessments assure the system designs meet their safety requirements and support the Airplane level safety 
assessment. 


The Airplane assessment process begins by identifying the Airplane functions and determining which 
Airplane functions are required for continued safe flight and landing. A Functional Hazard Assessment 
(FHA) is performed on the functions required for safe flight and landing to identify potentially catastrophic 
and hazardous failure conditions. For each failure condition, the Airplane architecture (i.e. systems) which 
implements the function is identified and the high-level system failure conditions are determined. An 
engineering assessment is performed to verify system failure conditions are being addressed by the 
individual systems. 


The basic structure of a system development process can be represented by a V-diagram, where time is 
represented horizontally (left to right) and system hierarchy is represented vertically (Reference, Figure 90). 
Initially (top left), the top-level design requirements (payload, range, passenger capacity, performance, etc) 
for the Airplane are selected. The Airplane requirements are then broken down into Airplane -level 
functions (e.g. control Airplane in the air); Airplane -level functions to system functions (e.g. control pitch, 
yaw and roll); system-level functions to systems (e.g. stabilizer system control); systems to subsystems (e.g. 
MCAS) in a top-down process. Following this system development process, requirements for each part item 
or piece of equipment are identified with each level providing validation of the level above. Validation is the 


process of ensuring that the requirements are sufficiently correct and complete. The right side of the V 
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diagram involves a series of bottom-up evaluation activities to ensure the requirements are verified as met 
at each level in integration of the final product. Verification is the process of ensuring that the final product 
meets the design requirements. Verification activities may include analysis and testing the individual item of 
equipment (e.g. flight control computer software) and then progressively integrating the equipment into a 
complete system and even flight testing for verification of a fully integrated system on the Airplane. 


Safety assessments are conducted by the applicant, and its suppliers, and are reviewed and approved by the 
FAA. The safety assessment process is outlined in AC 25.1309-1A and described in detail in SAE ARP4761. 
Although the safety assessment process outlined in the AC is not mandatory, the AC documents an 
established means, but not the only means, for an applicant to show compliance to the regulations. An 
applicant who chooses not to conduct safety assessments must demonstrate compliance in another way, 
which would have to be FAA-approved. 
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1.17.13.5 Functional Hazard Assessment (FHA) 


A functional hazard assessment (FHA) is a systematic examination of a system's functions and purpose, and 
it typically provides the initial, top-level assessment of a design and addresses the operational 
vulnerabilities of the system function. The FHA is therefore used to establish the safety requirements that 
guide system architecture design decisions. Performed independently of any specific design, an FHA 
evaluates what would occur if the function under question was lost or malfunctioned and classifies that 
effect to prioritize focus оп the most serious outcomes. An FHA is conducted early in the design and 
development cycle to identify failure conditions and classify them by severity, beginning at the Airplane 
level and working down to individual systems. 


FAA Advisory Circular AC 25.1309-1A, dated June 21, 1988 and SAE ARP4761 define the severity classes 
that are used to classify the effect of loss ог malfunction as part of an FHA. AC 25.1309-1A defines the 
following three severity classes: catastrophic, major and minor, with the respective likelihoods, of extremely 
improbable (one-in-a billion/10-9 or less), improbable (one-in-ten million/10-7 or less), or no worse than 
probable (one-in-hundred thousand/10-5). The differences among the classes are associated with effects on 
the Airplane, occupants, and crew. According to SAE ARP4761, the determination of the classification is 
accomplished by analyzing accident/incident data, reviewing regulatory guidance material, using previous 
design experience, and consulting with flight crews, if applicable. The failure condition severities 
classifications are provided in a table contained within this document and are defined as follows: 


- Catastrophic: prob of failure condition « 1E-09 
- Major: 1E-09 « prob of failure condition « 1E-05 
- Minor: no requirement on failure condition probability 


e Catastrophic: АП failure conditions which prevent continued safe flight and landing. 


е Severe-Major/Hazardous: Large reductions in safety margins or functional capabilities higher 
workload or physical distress such that the crew could not be relied upon to perform tasks accurately or 
completely 


* Major: Significant reduction in safety margins or functional capabilities significant increase in crew 
workload or in conditions impairing crew efficiency 


* Minor:A slight reduction in safety margins, a slight increase in crew workload 
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1.17.13.6 SYSTEM SAFETY ASSESSMENTS 


Safety assessments are a primary means of compliance for systems (as opposed to identifying structures or 
Airplane performance characteristics) that are critical to safe flight and operation. Safety assessments 
proceed in a stepwise, data-driven fashion, analogous to the system development process described above. 
Starting with Airplane functions, functional hazard assessments are performed to identify the failure 
conditions associated with each function. Systems functional hazard analyses are performed for system level 
functions. Preliminary safety assessments are performed as the system is developed adding more specific 
design and implementation detail to address specific hazards. The bottom-up Safety assessments are 
conducted by the applicant, and its suppliers, and are reviewed and accepted by the FAA. The safety 
assessment process is outlined in AC 25.1309-1A and described in detail in SAE ARP4761. Although the 
safety assessment process outlined in the AC is not mandatory, applicants who choose not to conduct safety 
assessments must demonstrate compliance in another, FAA-approved way (for example, by conducting 
ground or flight tests). 


1.17.13.7 Organization Designation Authorization 


In title 14, Code of Federal Regulations (CFR) United States of America Part 183, the Federal Aviation 
Administration (FAA) may delegate the specified functions to an organization on behalf of the Administrator 
related to engineering, manufacturing, operations, airworthiness, or maintenance. 
In the Part 183 subpart D, the organization granted by the FAA for such delegation is referred as 
Organization Designation Authorization (ODA) which means the organization is authorized to perform 
certification functions on behalf of the FAA. FAA granted the Boeing Commercial Airplane (BCA) ODA in 
2009. The delegated functions for a Type Certification ODA are: 

* establishing and determining conformity of parts, assemblies, installations, test setups, and products 

(Airplane); 

e finding compliance with airworthiness standards for new design, or major changes to design; 

e issuing special flight permits for operation of Airplane; 


е issuing issues airworthiness approvals for articles (Export), and Airplane (Standard or Export) 
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1.17.13.8 Oversight and Delegation 


Inspector General Audit Report 


According to a 2011 Office of Inspector General Audit report??, "the FAA is responsible for overseeing 
numerous aviation activities designed to ensure the safety of the flying public. Recognizing that it is not 
possible for FAA employees to personally oversee every facet of aviation, public law allows FAA to delegate 
certain functions, such as approving new Airplane designs, to private individuals or organizations (approved 
by the FAA). Designees perform a substantial amount of critical work on FAA's behalf—for example, at one 
Airplane manufacturer, they made about 90 percent of the regulatory compliance determinations for a new 
Airplane design. FAA created the Organization Designation Authorization (ODA) program in 2005 to 
standardize its oversight of organizational designees." 

According to FAA Order 8100.15A, 49 CFR 44702(d) allows the FAA to delegate to a qualified private person 
a matter related to issuing certificates, or related to the examination, testing, and inspection necessary to 
issue a certificate on behalf of the FAA Administrator as authorized by statute to issue under 49 CFR 44702 


(a). 


Boeing applied for and was granted ODA. Boeing's ODA is authorized to select and appoint individuals to 
perform some of the delegated functions as representatives of FAA. The delegated functions for a Type 
Certification (TC) ODA are: 


е establishing and determining conformity of parts, assemblies, installations, test setups, and products 
(Airplane); 


e finding compliance with airworthiness standards for new design, or major changes to design; 
e issuing special flight permits for operation of Airplane; 
е issuing issues airworthiness approvals for articles (Export), and Airplane (Standard or Export) 
1.17.13.9 Guidance for Delegation of Compliance Findings 
FAA Order 8110.4C, section 2.5, titled "Compliance Planning," discusses the FAA's involvement in a 
certification project, including providing guidance on oversight and delegation. According to the order, "For 


planningpurposes, the FAA's and the applicant's certification teams need to Know in which aspects of the 
project the FAA intends involvement and at what level. The heavy workloads for FAA personnel limit 


23 Reference Office of Inspector General Audit Report, AV-2011-136, issued on June 29, 2011 
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involvement in certificationactivities to a small fraction of the whole. FAA type certification team members 
must review the applicant's design descriptions and project plans, determine where their attention will 
derive the most benefit, and coordinate their intentions with the applicant." 


Paragraph (a) (1) of section 2.5 provides guidance to the FAA and applicant on the identification of critical 
safety items requiring direct FAA involvement in the findings of compliance. According to the paragraph, 
"When a particular decision or event is critical to the safety of the product or to the determination of 
compliance, the FAA must be directly involved (as opposed to indirect FAA involvement by, for example, 
DER). Project team members must build on their experience to identify critical issues. Some key issues that 
will always require direct FAA involvement include rulemaking (such as for special conditions), 
development of issue papers, and compliance findings considered unusual or typically reserved for the FAA. 
While these items establish the minimum direct FAA involvement, additional critical safety findings must 
also be identified based on the safety impact or the complexity of the requirement or the method of 
compliance. Additional factors to consider in determining the areas of direct FAA involvement include the 
FAA's confidence in the applicant, the applicant's experience, the applicant's internal processes, and 
confidence in the designees." 


1.17.13.10Delegation of Deliverables 


CP13471 proposed delegation of all Flight Controls Primary & Secondary compliance findings. On April 14, 
2015, the FAA approved the delegation of several deliverables; however, they indicated that the deliverable 
titled "737 Stabilizer System Description and Safety Analysis" (SSA) would be retained by the FAA and will 
not be proposed for delegation. In November 2016, Boeing submitted the 737 Stabilizer System Description 
and Safety Analysis (SSA), revision F, to the FAA for acceptance." In December 2016, the FAA's response to 
Boeing was to "accept" the submittal and with notation "delegated SSA approval to ODA." 


Retention and delegation are accomplished with respect to compliance deliverables not to specific 
functions i.e., MCAS itself would not be delegated to the ODA. 


e Consistent with the FAA authorization, the FAA have discretionary authority as to what is reviewed, 
whether submitted directly to the FAA for review and approval by an applicant or submitted by a 
designee or ODA recommending approval. 

e When delegating at the end of a program, there has been some level of FAA involvement and the 
delegation confirms that the designee should make the final approval. 


e In all cases, delegation is not accomplished by a single individual but follows a structured review 
process. 
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1.17.14 MANEUVERING CHARACTERISTICS AUGMENTATION SYSTEM (MCAS) 
1.17.14.1 The Need for MCAS on B737 MAX 


The 737 MAX 8 is a derivative of the 737-800 Model and is part of the 737 MAX families (737 MAX 7, 8, and 
924), The 737MAX incorporated the СЕМ LEAP-1B engine, which has a larger fan diameter and redesigned 
engine nacelle compared to engines installed on the 737 Next Generation (NG) families. Because the 737-8 
is a derivative of the 737-800 model, its certification basis, which was established per 14 CFR 21.101 
Changed Product Rule, required Boeing to demonstrate compliance with part 25 as amended by 
amendments 25-0-137, plus amendment 25-141 with exceptions permitted by 14CFR 21.101 for significant 
areas of change at the product level and those areas affected by the significant product level change. 


During the preliminary design stage of the 737 MAX 8, Boeing tests and analysis revealed that the addition 
of the LEAP-1B engine and associated nacelle changes produced an Airplane nose-up pitching moment 
when the Airplane was operating at high angles of attack (AOA) and mid Mach numbers. This nose-up 
pitching moment was deemed likely to affect the stick force per g (FS/g) characteristics required by FAR 
25.251, FAR 25.255, and the controllability and maneuverability requirements of FAR 25.143(f). 


After the study of various options for addressing this issue, Boeing implemented aerodynamic changes as 
well as a stability augmentation function called the Maneuvering Characteristics Augmentation System 
(MCAS), as an extension of the existing Speed Trim System (STS), to improve Airplane handling 
characteristics and improve static longitudinal stability at elevated angles of attack. 


As the development of the 737 MAX- 8 progressed, the MCAS function was expanded to low Mach numbers 
to comply with the stall characterstics requirements specified in FAR 25.201 and FAR 25.203. MCAS is 
designed to function only during manual flight (autopilot not engaged), with the Airplane's flaps up, at an 
elevated AOA. 


Speed Trim & MCAS Description 


To ensure that the 737-600/700/800/900 (737 NG) family of Airplanesmet the certification requirements 
for longitudinal static stability (speed stability), the Airplanes incorporated a Speed Trim System (STS) to 


** Both the 737-8 and 737-9 were in service at the time of the accident. The 737-7 and 737-10 are planned future derivatives that have not 
yet entered service. 
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augment the basic Airplane's speed stability during certain low speed, high thrust flight conditions by 
moving the horizontal stabilizer during manual flight (autopilot is not engaged). For the 737 NG families of 
Airplane s, the Speed Trim System included the Speed Trim Function. The STS was carried over to the 737- 
7/-8/-9 (737 MAX) family of Airplanes. Additionally, on 737 MAXAirplanes, the MCAS function was added to 
the STS to address the pitch characteristics described above. 


Speed Trim Function 


The Speed Trim function, which is implemented as a control law within the flight control computer (ЕСС25), 
commands incremental stabilizer trim through the automatic trim control system circuitry. There are two 
different stabilizer trim rates depending on the position of the flaps?*. A schedule determines the desired 
incremental stab deviation from the last trimmed position as a function of airspeed and flap position. 


According to the Enhanced Digital Flight Control System (EDFCS) system safety analysis (SSA), the worst- 
case failure mode of the Speed Trimsystem was considered to be a runaway of the horizontal stabilizer trim 
actuator (HSTA) as a result of sensor or FCC failures, or FCC-to-stab trim motor (STM) wiring failures. The 
SSA indicated that during the runaway, the pilot is able to detect the fault by noticing the continuous running 
of the trim mechanical wheels in the flight deck or by the change in column force necessary to maintain pitch 
attitude, or through change in Airplane pitch attitude. The SSA indicated that the pilot compensates for the 
runaway through: 
e column input in the direction opposing the uncommanded trim until activation of the column activated 
trim cutout switches, or 
e activation of the main electric trim by either pilot in a direction opposing the uncommanded motion, 
which overrides the FCC commanded trim runaway, or 
e moving the guarded stabilizer trim cutout switches?" located on the aisle stand to the CUTOUT 


position, or restraining the stabilizer trim wheel, 


e Speed/ Stab Trim runaways are limited by the inherent stab trim motor rate and column actuated trim 
cut-out switches. Sufficient means are available for the pilot to maintain control and recover from the 
runaway??, 


25 The flight control computers (FCC) are part of the digital flight control system. 

26 When the flaps are down, the stabilizer rate is three times faster than when the flaps are up. 

27 Two stabilizer trim cutout switches on the control stand can be used to stop the main electric and autopilot trim inputs to the stabilizer 
trim actuator. The switches can be set to NORMAL or CUTOUT. If either switch is moved to CUTOUT both the electric and autopilot trim 
inputs are disconnected from the stabilizer trim motor. NORMAL is the default position to enable operation of the electric and autopilot 
trim. 
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1.17.14.2 Functional Hazard Assessment (FHA) 


A functional hazard assessment (FHA) is a systematic examination of a system's functions and purpose, and 
it typically provides the initial, top-level assessment of a design and addresses the operational 
vulnerabilities of the system function.The FHA is therefore typically used to establish the safety 
requirements that guide system architecture design decisions. An FHA evaluates what would occur (the 
"hazard" in FHA) if the function under question was lost or malfunctioned and classifies the severity of that 
effect. An FHA is conducted early in the design and development cycle to identify hazards and classify them 
by severity, beginning at the Airplane level and working down to individual systems. 


Federal Aviation Administration (FAA) Advisory Circular AC 25.1309-1A, dated June 21, 1988 and SAE 
ARP4761define the severity classes that are used to classify the effect of loss or malfunction as part of a FHA. 
AC 25.1309-1A defines the following three severity classes: catastrophic, major and minor, with 
corresponding acceptable probabilitiesof extremely improbable (1E-9) or less per flight hour), improbable 
(1E-5 or less), and no worse than probable (1E-3). European regulations (originally JAR and now EASA) 
include an additional category: hazardous, which falls between catastrophic and major and has an 
associated acceptable probability of 1E-7 or less. The differences among the classes are associated with 
effects on the Airplane, occupants, and crew. 


To begin an FHA, engineering judgment is used to identify the failure conditions which require evaluation. 
According to the FHA sections?? of Boeing's 737 NG/MAX Stabilizer Trim Control System Safety Analysis, 
(Reference section H.2.2 of this report), performance analyses and piloted simulations were accomplished as 
needed to help define the hazard categories for the identified conditions. SourceError! Reference source 
ot found. Shows the criticality categories used in developing the FHA and the corresponding minimum 
acceptable probabilities of occurrence. The failure conditions defined by the FHA provide the basis for the 
top-level events analyzed by the Fault Tree Analysis (FTA) to demonstrate compliance with FAR 
25.671(с)(2) and 25.1309(b)(1). A fault tree analysis was performed on each failure condition determined 
to be either Catastrophic or Hazardous. Additionally, Major events are included in the FHA for reference, per 
FAA/JAA request. 


?8 MCAS failures do allow the stabilizer to move at the flaps down trim rate, even if the flaps are up, but even the flaps down trim rate is a 
limit, albeit faster than the normal flaps up rate. Column cutout is always available in the forward direction but may not be available in 
the aft direction for certain MCAS failures. 


29Тһе safety analysis contained two sections that discussed hazard analysis; the first FHA was developed for the 737NG in the original 
release of the analysis (1997) and the second FHA was developed as part of the 737 MAX changes (2016). 
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FAR - AC 
25.1309-1A 
definitions. 


ANIJ No.1 of 
JAR 25.1309 
definitions. 


Effects on 
aircraft 
and 
occupants 
of the 
identified 
failure 
condition. 


TABLE 26: FAILURE EFFECT CATEGORIES 
FAR/JAR Failure Effect Category Definitions 


No significant 
degradation of 
aircraft capability. 
Crew actions well 
within their 
capabilities. 

Slight reduction of 
safety margins, 


Slight increase in 
work load, (e.g. 
routine changes in 
flight plan), or 


Physical effects but 
no injury to 
occupants. 


Reduction of thc aircraft capability or of the 
crew ability to cope with adverse operating 


conditions. 


Significant reduction 
in safety margins, 


Reduction in the 
ability of the flight 
crew to cope with 
adverse operating 
conditions impairing 
their efficiency, or 


Injury to occupants. 


Large reduction in 
safety margins, 


Physical distress or 
workload such that 
the flight crew cannot 
be relied upon to 
perform their tasks 
accurately or 
completely, or 


Serious injury to or 
death of a relatively 
small portion of the 


Prevention of 
continued safe flight 
and landing of the 
aircraft. 


Loss of the aircraft 
and/or fatalities. 


December 2022 


occupants. 


Non-essential Essential Critical 
(Level 3 software) (Level 2 software) {Level 1 software) 

Criticality category Minor Major Hazardous Catastrophic 
RTCA DO-178B (Level D software) (Level C software) (Level B software) (Level A software) 
FAR qualitative 
probability terms. Probable 
JAR qualitative к 
probability terms. кецсе 
FAR апа ТАК quantitativc 
probability ranges. 


As part of the MCAS development phase, in late 2012, Boeing performed a preliminary functional hazard 
assessment?? of MCAS using piloted simulations in their full motion Engineering Flight Simulator; the results 
were documented in an internal Boeing document?! (an MCAS requirements document). Several hazards 


FAR effect category 
AC 25.1309-1A. 


JAR effect category 
AMJ No. 1 of JAR 25.1309 


Criticality category 
RTCA DO-178A 


Hazardous 


Extremely 


Improbable Improbable 


Reasonably 


Probable 


Extremely 
Improbable 


Extremely 


Remote Remote 


10-5 10-7 
Probability of Failure Condition 
(for one flight hour or flight if less than onc hour). 


30The hazard assessments were developed as part of Aircraft certification and based on AC 25.1309-1A. 

31This requirements document, which defined the requirements for the MCAS function, formally conveyed the information regarding the 
safety impact of the design Change; it included documentation on the FHA and the results of that analysis. A March 30, 2016 revision to 
this document specifically reflects that the FHA was updated following the MCAS design change, and documents that the hazard 
classification categories for the expanded MCAS design satisfied all applicable regulatory and certification requirements. This document was 
circulated by 32Aerodynamics S&C to subject matter experts in the Primary Flight Controls, Autoflight and Flight Test (including the 737 Chief Pilots) and 
the Requirements groups. 
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were assessed at that time; however, this section of the report will focus only on the following two hazards: 
uncommanded MCAS operation up to its Maximum authority (0.6 degrees of Airplane nose down stabilizer) 
апа uncommanded MCAS operation equivalent to a three (3) second stabilizer trim runaway??. To perform 
these simulator tests, Boeing induced a stabilizer trim input that would simulate the stabilizer moving at a 
rate and duration consistent with the MCAS function. Using this method to induce the hazard resulted in the 
following motion of the stabilizer trim wheel, increased column forces, and indication that the Airplane was 
moving nose down. Boeing indicated to the NTSB that this evaluation was focused on the pilot response to 
uncommanded MCAS operation, regardless of underlying cause. Thus, the specific failure modes that could 
lead to uncommanded MCAS activation, such as an erroneous high AOA input to the MCAS, were not 
simulated as part of these functional hazard assessment validation tests. As a result, additional flight deck 
effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the 
same underlying failure (for example, erroneous AOA) were not simulated and were not documented in the 
stabilizer trim and autoflight safety assessment reports reviewed by the NTSB. 


TABLE27: ORIGINAL RESULTS OF PRELIMINARY HAZARD ASSESSMENT 
Hazard Hazard classification 


Uncommanded MCAS operation up to its Maximum authority Major 


Uncommanded MCAS function operation equivalent to a | Major 
3second mistrim 


The FHA evaluations were conducted by Boeing in their Engineering Cab using FAA guidance regarding pilot 
response to flight control failures requiring trim input that is contained іп FAA Advisory Circular AC25.7C*5. 
In particular, Boeing uses the following assumptions in its flight controls FHAs: 


Uncommanded system inputs are readily recognizable and can be counteracted by overriding the failure by 
movement of the flight controls in the normal sense by the flight crew and do not require specific 
procedures. 


Action to counter the failure shall not require exceptional piloting skill or strength. 


32The two events were assumed to start from a trimmed condition. Boeing also considered the hazard of uncommanded MCAS operation until pilot 
response. This condition had the same severity as the 3-second case. 
33FAA advisory circular (AC) 25-7C, titled, "Flight Test Guide for Certification of Transport Category Aircrafts," dated October 16, 2012, provides guidance 


for the flight test evaluation of transport category Aircrafts. 
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The pilot will take immediate action to reduce or eliminate increased control forces by re-trimming or 
changing configuration or flight conditions. 


Trained flight crew memory procedures shall be followed to address and eliminate or mitigate the failure. 


Boeing advised that these assumptions are used across all Boeing models when performing functional 
hazard assessments of flight control systems and that these assumptions are consistent with the 
requirements contained in 14 CFR 25.671 & 25.672 and within the guidance contained in FAA Advisory 
Circular (AC) 25-7C for compliance evaluation of 14 CFR 25.14334, 


In March 2016, Boeing determined that MCAS should be revised to improve wings-level, flaps up, low Mach 
stall characteristics and identification. The MCAS was revised such that depending on AOA, it would be 
capable of commanding incremental stabilizer to a maximum of 2.5 degrees at low Mach decreasing to a 
Maximum of 0.65 degrees at high Mach. 


Boeing's requirements document indicated that the preliminary functional hazard assessments of MCAS 
were re-evaluated by pilot assessments in the motion simulator and by engineering analysis and determined 
to have not changed in hazard classification as a result of the increase in MCAS authority to 2.5 degrees at 
low speed. 


TABLE 28: RESULTS OF PRELIMINARY HAZARD ASSESSMENT FOR REVISED MCAS AUTHORITY 


Hazard Hazard 
classification 
Uncommanded MCAS function operation up to its maximum authority Major* 


Uncommanded MCAS function operation equivalent to a 3 second mistrim ** | Major 


*Major Classification: 


The uncommanded MCAS command to the Maximum nose down authority at low Mach numbers was 
evaluated in the 737 MAX cab and rated as Minor.The high Mach uncommanded MCAS command and 
subsequent recovery is the critical flight phase in establishing the hazard rating for erroneous MCAS 
commands. 


34 FAR 25.143(g) Controllability and Maneuverability - General, requires that changes of gradient that occur with changes of load factor 
must not cause undue difficulty in maintaining control of the Aircraft, and local gradients must not be so low as to result in a danger of 
over-controlling. Reference is made to CFR amendment 25-129 for the described FAR 25.143(g) requirement. 
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** Piloted Simulation not required: 


According to Boeing, Engineering analysis determined no low Mach piloted simulation to be required as this 
failure is less critical than MCAS function operation to Maximum authority. Stabilizer motion for three 
seconds would not reach Maximum authority in low Mach conditions. The existing high Mach evaluations 
remain valid as the aerodynamic configuration has not changed significantly since the preflight evaluations, 
and the 3 second stabilizer motion is the same magnitude. 


When assessing unintended MCAS activation in the simulator for the FHAs, the function was allowed to 
perform to its authority and beyond before pilot action was taken to recover. Failures were able to be 
countered by using elevator alone. Stabilizer trim was available to offload column forces, and stabilizer 
cutouts were available but not required to counter failures. This was true both for the preliminary FHAs 
performed in 2012 and for the reassessment of the FHAs in 2016. 


In a 2019 presentation to the NTSB, Boeing indicated that the MCAS hazard classification of "major" for 
uncommanded MCAS function (including up to the new authority limits) in the Normal flight envelope were 
based on the following conclusions: 


Unintended stabilizer trim inputs are readily recognized by movement of the stab trim wheel, flight path 
change or increased column forces. 


Airplane can be returned to steady level flight using available column (elevator) alone or stabilizer trim. 


Continuous unintended nose down stabilizer trim inputs would be recognized as a Stab Trim or Stab 
Runaway failure and procedure for Stab Runaway would be followed. 


Boeing indicated that as part of the development process of MCAS, although not formally part of the FHA, 
engineering personnel and test pilots considered the scenario of multiple MCAS inputs due to pilot trim 
action following an erroneous AOA input. Their assessment was that each MCAS input could be controlled 
with column alone and subsequently re-trimmed to zero column force while maintaining the flight path. 
Five seconds after cessation of the pilot trim command, the subsequent MCAS command could be controlled 
in the same manner as the previous instance. Eventually, use of the stabilizer cutout switches would be an 
option to stop the uncommanded stabilizer motion per the runaway stabilizer procedure (which is a trained 
flight crew memory item). 


204 


Aircraft Accident Investigation Report B737- МАХ 8, ET-AVJ December 2022 


1.17.15 ECAA TYPE CERTIFICATE ACCEPTANCE PROCESS 


Referring to Ethiopian Civil Aviation Rules & Standards Part 5 - Airworthiness, section 5.2.1.5 Acceptance of 
Type Certificateevery Airplane, Airplaneengine, and Airplane propeller designed and produced overseas and 
imported into Ethiopia must obtain a type certificate acceptance. The Civil Aviation Rules & Standards 
(ECARAS Part 5-Airworthiness regulates the compliance procedure for the Ethiopian Civil Aviation 
Proclamation 1179/2020 and it is outlined in the Ethiopian Civil Aviation Authority's Airworthiness 
Inspector Handbook Part 2, Chapter 2-27 Type Certificate Acceptance process (Airplane , Engine and 
Propeller). 


1.17.15.1 Airworthiness RegulationsAirworthiness Standard for Type Certificate 


Airplane type certificate is issued by civil aviation authority to ensure the Airplane is manufactured in 
accordance with approved design and a product meets its type design and is in a condition for safe 
operation. The airworthiness standards for the issue of type acceptance certificates, and changes to those 
certificates, for transport category Airplanes in Ethiopia is described in the ECARAS PART 5 - Airworthiness: 
Transport Category and in the United States of America described in Federal Aviation Regulation (FAR) Part 
25. Ethiopian Civil Aviation Rules and Standards Part 5 - Airworthiness section 5.2.1.2 states that Ethiopia 
accepts type certificates issued by Federal Aviation Administration (FAA) of the United States of America. 


The relevant subparts in FAR related with Airplane certification requirements were as follows: 


25.1 Applicability 
a. This part prescribes airworthiness standards for the issue of type certificates, and changes to those 


certificates, for transport category Airplane s. 
b. ECARAS PART 5, Section 5.2.1.5 states that the Authority may accept a type certificate or equivalent 
document issued by a State of Design in respect of an Airplane or Airplane component if: 


The type certificate or equivalent document was issued based on an airworthiness code recognized by the 
Authority; 


25.143 General. 
a. The Airplane must be safely controllable and maneuverable during— 


1. Takeoff, 

2. Climb; 

3. Level flight; 
4. Descent; and 


205 


Aircraft Accident Investigation Report B737- MAX 8, ET-AVJ December 2022 


5. Landing. 
b. It must be possible to make a smooth transition from one flight condition to any other flight condition 
without exceptional piloting skill, alertness, or strength, and without danger of exceeding the Airplane limit- 
load factor under any probable operating conditions, including— 


1. The sudden failure of the critical engine; 
2. For Airplane with three or more engines, the sudden failure of the second critical engine when the 


Airplane is in the en route, approach, or landing configuration and is trimmed with the critical 
engine inoperative; and 
3. Configuration changes, including deployment or retraction of deceleration devices. 
c. The Airplane must be shown to be safely controllable and maneuverable with the critical ice accretion 
appropriate to the phase of flight defined in appendix C, and with the critical engine inoperative and its 
propeller (if applicable) in the minimum drag position: 
1. Atthe minimum V2 for takeoff; 
2. During an approach and go-around; and 
3. During an approach and landing. 
d. The following table prescribes, for conventional wheel type controls, the Maximum control forces 


permitted during the testing required by paragraphs (a) and (c) of this section: 

e. Approved operating procedures or conventional operating practices must be followed when 
demonstrating compliance with the control force limitations for short term application that are 
prescribed in paragraph (d) of this section. The Airplane must be in trim, or as near to being in trim as 
practical, in the preceding steady flight condition. For the takeoff condition, the Airplane must be 
trimmed according to the approved operating procedures. 25.255 Out-of-trim characteristics. 

a. From an initial condition with the Airplane trimmed at cruise speeds up to УМО/ММО, the air-plane 
must have satisfactory maneuvering stability and controllability with the degree of out-of-trim in both 
the Airplane nose-up and nose-down directions, which results from the greater of — 

1. A three-second movement of the longitudinal trim system at its normal rate for the particular flight 
condition with no aerodynamic load (or an equivalent degree of trim for Airplanesthat do not have a 
power-operated trim system), except as limited by stops in the trim system, including those required 
by §25.655(b) for adjustable stabilizers; or 


2. The Maximum mistrim that can be sustained by the autopilot while maintaining level flight in the 
high speed cruising condition. 
b. In the out-of-trim condition specified in paragraph (a) of this section, when the normal acceleration is 


varied from +1 g to the positive and negative values specified in paragraph c. of this section — 
1. The stick force vs. g curve must have a positive slope at any speed up to and including VFC/MFC; and 
2. At speeds between VFC/MFC and VDF/MDF the direction of the primary longitudinal control force 
may not reverse. 
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c. Except as provided in paragraphs (d) and (e) of this section, compliance with the provisions of paragraph 
(a) of this section must be demonstrated in flight over the acceleration range — 


1.-1gto +2.5 g; or 
2.0 g to 2.0 g, and extrapolating by an accept-able method to -1 g and 42.5 g 
d. If the procedure set forth in paragraph (c) (2)of this section is used to demonstrate compliance and 


marginal conditions exist during flight test with regard to reversal of primary longitudinal control force, 
flight tests must be accomplished from the normal acceleration at which a marginal condition is found to 
exist to the applicable limit specified in paragraph (b)(1) of this section. 
e. During flight tests required by paragraph (a) of this section, the limit maneuvering load factors 
prescribed in §§25.333(b) and 25.337, and the maneuvering load factors associated with probable 
inadvertent excursions beyond the boundaries of the buffet onset envelopes determined 
under$25.251(e), need not be exceeded. In addition, the entry speeds for flight test demonstrations at 
normal acceleration values less than 1 g must be limited to the extent necessary to accomplish a 
recovery without exceeding VDF/MDF.(f)In the out-of-trim condition specified in para-graph (a) of this 
section, it must be possible from an over speed condition at VDF/MDF to produce at least 1.5g for 
recovery by applying not more than125 pounds of longitudinal control force using either the primary 
longitudinal control alone or the primary longitudinal control and the longitudinal trim system. If the 
longitudinal trim is used to assist in producing the required load factor, it must be shown at VDF/MDF 
that the longitudinal trim can be actuated in the Airplane nose-up direction with the primary surface 
loaded to correspond to the least of the following Airplane nose-up control forces: 
е The Maximum control forces expected in service as specified in §§25.301 and 25.397. 
е The control force required to produce 1.5 с. 
e The control force corresponding to buffeting or other phenomena of such intensity that it is a strong 
deterrent to further application of primary longitudinal control force. 


25.1309 Equipment, Systems, and Installations 


a. The equipment, systems, and installations whose functioning is required by this Decree, must be 

designed to ensure that they perform their intended functions under any foreseeable operating 

condition. 

b. The Airplane systems and associated components, considered separately and in relation to other 

systems, must be designed so that- 

1. The occurrence of any failure condition which would prevent the continued safe flight and landing of 
the Airplane is extremely improbable, and 
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2. The occurrence of any other failure conditions which would reduce the capability of the Airplane or 
the ability of the crew to cope with adverse operating conditions is improbable. 

c. Warning information must be provided to alert the crew to unsafe system operating conditions, and to 

enable them to take appropriate corrective action. Systems, controls, and associated monitoring and 

warning means must be designed to minimize crew errors which could create additional hazards. 

d. Compliance with the requirements of paragraph (b) of this section must be shown by analysis, and 

where necessary, by appropriate ground, flight, or simulator tests. The analysis must consider 

1. Possible modes of failure, including malfunctions and damage from external sources. 

2. The probability of multiple failures and undetected failures. 

3. The resulting effects on the Airplane and occupants, considering the stage of flight and operating 
conditions, and 

4. Тһе crew warning cues, corrective action required, and the capability of detecting faults. 

e. In showing compliance with paragraphs (a) and (b) of this section with regard to the electrical system 

and equipment design and installation, critical environmental conditions must be considered. For 

electrical generation, distribution, and utilization equipment required by or used in complying with this 

chapter, except equipment covered by Approved 

Technical Specification or Technical Standard Orders containing environmental test procedures, the 

ability to provide continuous, safe service under foreseeable environmental conditions may be shown by 

environmental tests, design analysis, or reference to previous comparable service experience on other 

Airplanes 

f. EWIS must be assessed in accordance with the requirements of sec.25.1709. 

25.1329 Flight guidance system. 

g. Under any condition of flight appropriate to its use, the flight guidance system may not produce 

hazardous loads on the Airplane, nor create hazardous deviations in the flight path. This applies to both 

fault-free operation and in the event of a malfunction, and assumes that the pilot begins corrective action 

within a reasonable period of time. 

25.1585 Operating Procedures 

a. Operating procedures must be furnished for— 

1. Normal procedures peculiar to the particular type or model encountered in connection with routine 
operations; 

2. Non-normal procedures for malfunction cases and failure conditions involving the use of special 
systems or the alternative use of regular systems; and 
Emergency procedures for foreseeable but unusual situations in which immediate and precise action 
by the crew may be expected to substantially reduce the risk of catastrophe. 
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b. Information or procedures not directly related to airworthiness or not under the control of the crew 
must not be included, nor must any procedure that is accepted as basic airmanship. 

c. Information identifying each operating condition in which the fuel system independence prescribed in 
Sec. 25.953 is necessary for safety must be furnished, together with instructions for placing the fuel 
system in a configuration used to show compliance with that section. 

d. The buffet onset envelopes, determined under Sec. 25.251 must be furnished. The buffet onset 
envelopes presented may reflect the center of gravity at which the Airplane is normally loaded during 
cruise if corrections for the effect of different center of gravity locations are furnished. 


1.17.15.2 The Responsibility for Airworthiness 


The Ethiopian Civil Aviation Rules and Standards (ECARAS) PART 9 — Air Operator Certification and 
Administration are applicable for the operation of Airplane within Ethiopian territory. 

The Ethiopian Civil Aviation Rules and Standards (ECARAS) PART 9 subpart 9.2.3 describes: 

(a) No person may operate an Airplane in commercial air transport unless that Airplane has an appropriate 
current airworthiness certificate, is in an airworthy condition, and meets the applicable airworthiness 
requirements for these operations, including those related to identification and equipment. 


(b) The pilot in command of a civil Airplane is responsible for determining whether that Airplane is in 
condition for safe flight. The pilot in command shall discontinue the flight when un-airworthy mechanical, 
electrical, or structural conditions occur. (a) Each certificate holder is primarily responsible for 

The Ethiopian Civil Aviation Rules and Standards (ECARAS) PART 9 — Air Operator Certification and 
Administrationrelated to regulation for Airplane maintenance responsibility is as follows: 


Ethiopian Civil Aviation Rules and Standards (ECARAS) Part 9 Maintenance Responsibilities 
(Responsibilities for Airworthiness): 


(1) (a) Each AOC holder shall ensure the airworthiness of the Airplane and the serviceability of both 
operational and emergency equipment by:- 


(1) Assuring the accomplishment of preflight inspections; 


(2) Assuring the correction of any defect and/or damage affecting safe operation of an Airplane to an 
approved standard, taking into account the MEL and CDL if available for the Airplane type; 


(3) Assuring the accomplishment of all maintenance in accordance with the approved operator's Airplane 
maintenance program; 


(4) The analysis of the effectiveness of the AOC holder's approved Airplane maintenance program; 
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(5) Assuring the accomplishment of any operational directive, airworthiness directive and any other 
continued airworthiness requirement made mandatory by the Authority; and 


(6) Assuring the accomplishment of modifications in accordance with an approved standard and, for non- 
mandatory modifications, the establishment of an embodiment policy. 


(b) Each AOC holder shall ensure that the Certificate of Airworthiness for each Airplane operated remains 
valid in respect to:- 


(1) The requirements in paragraph (a); 
(2) The expiration date of the Certificate; and 
(3) Any other maintenance condition specified in the Certificate. 


(c) Each AOC holder shall ensure that the requirements specified in paragraph (a) are performed in 
accordance with procedures approved by or acceptable to the Authority. 


(d) Each AOC holder shall ensure that the maintenance, preventive maintenance, and modification of its 
Airplane /aeronautical products are performed in accordance with its maintenance control manual and/or 
current instructions for continued airworthiness, and applicable aviation rules and standards. 


(e) Each AOC holder may make an arrangement with another person or entity for the performance of any 
maintenance, preventive maintenance, or modifications; but shall remain responsible of all work performed 
under such arrangement. 


(f) An operator shall not operate an Airplane unless it is maintained and released to service by either an 
AMO certificated under Part 6 or by an equivalent system of maintenance, either of which shall be 
acceptable to the Authority If an equivalent system to an AMO is used, the AOC holder shall ensure that the 
person signing the maintenance release is licensed in accordance with Part 2. 


(g) Each operator shall ensure that the maintenance of its Airplane is performed in accordance with the 
approved maintenance programmed. 


(3) The operator of an Airplane over 5,700 kg Maximum certificated take-off mass and helicopter over 3175 
kg Maximum certificated take-off mass shall monitor and assess maintenance and operational experience 
with respect to continuing airworthiness and provide the information as prescribed by the Ethiopian Civil 
Aviation Authority through the system specified in ECARAS Part 5.5.1.5. 
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(4) The operator an Airplane over 5700 kg Maximum certificated take-off mass and helicopter over 3175kg 
Maximum certificated take-off mass shall obtain and assess continuing airworthiness information and 
recommendations available from the organization responsible for the type design and shall implement 
resulting actions considered necessary in accordance with a procedure acceptable to the Ethiopian Civil 
Aviation Authority. 


FAR related with Airplane CertificationRequirements:- 
- This part prescribes airworthiness standards for the issue of type certificates, and changes to those 
certificates, for transport category Airplane s. 
- ECARAS PART 5, Section 5.2.1.5 states that the Authority may accept a type certificate or equivalent 
document issued by a State of Design in respect of an Airplane or Airplane component if: 


The type certificate or equivalent document was issued based on an airworthiness code recognized by the 
Authority; 


25.143 General. 
a. The Airplane must be safely controllable and maneuverable during: -Takeoff, Climb, Level flight, Descent, 
and Landing. 

b. It must be possible to make a smooth transition from one flight condition to any other flight condition 
without exceptional piloting skill, alertness, or strength, and without danger of exceeding the Airplane 
limit-load factor under any probable operating conditions, including— 

-The sudden failure of the critical engine; 

-For Airplaneswith three or more engines, the sudden failure of the second critical engine when the 
Airplane is in the en route, approach, or landing configuration and is trimmed with the critical engine 
inoperative; and 

-Configuration changes, including deployment or retraction of deceleration devices. 

c. The Airplane must be shown to be safely controllable and maneuverable with the critical ice 
accretion appropriate to the phase of flight defined in appendix C of the ECARAS and with the critical 
engine inoperative and its propeller (if applicable) in the minimum drag position: 

4. Atthe minimum V; for takeoff; 
5. During an approach and go-around; and 
6. During an approach and landing. 

d. For conventional wheel type controls, the Maximum control forces permitted during the testing 

required by paragraphs (a) and (c) ofthis section: 

e. Approved operating procedures or conventional operating practices must be followed when 

demonstrating compliance with the control force limitations for short term application that are 
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prescribed in paragraph (d) of this section. The Airplane must be in trim, or as near to being in trim as 
practical, in the preceding steady flight condition. For the takeoff condition, the Airplane must be 
trimmed according to the approved operating procedures. 25.255 Out-of-trim characteristics. 
a. From an initial condition with the Airplane trimmed at cruise speeds up to УМО/ММО, the Airplane 
must have satisfactory maneuvering stability and controllability with the degree of out-of-trim in both 
the Airplane nose-up and nose-down directions, which results from the greater of — 
3. A three-second movement of the longitudinal trim system at its normal rate for the particular flight 
condition with no aerodynamic load (or an equivalent degree of trim for Airplanes that do not have 
a power-operated trim system), except as limited by stops in the trim system, including those 
required by §25.655(b) for adjustable stabilizers; or 
4. The Maximum mistrim that can be sustained by the autopilot while maintaining level flight in the 
high speed cruising condition. 
b. In the out-of-trim condition specified in paragraph (a) of this section, when the normal acceleration is 
varied from +1 g to the positive and negative values specified in paragraph c. of this section — 
1. The stick force vs. g curve must have a positive slope at any speed up to and including 
VFC/MFC; and 
2. At speeds between VFC/MFC and VDF/MDF the direction of the primary longitudinal 
control force may not reverse. 
c. Except as provided in paragraphs (d) and (e) of this section, compliance with the provisions of paragraph 
(a) of this section must be demonstrated in flight over the acceleration range — 


1. -1gto-*2.5g;or 

2. Ogto 2.0 g, and extrapolating by an accept-able method to -1 g and +2.5 g 
d. If the procedure set forth in paragraph (c)(2)of this section is used to demonstrate compliance and 
marginal conditions exist during flight test with regard to reversal of primary longitudinal control force, 
flight tests must be accomplished from the normal acceleration at which a marginal condition is found to 
exist to the applicable limit specified in paragraph (b)(1) of this section. 

During flight tests required by paragraph (a)of this section, the limit maneuvering load factors 
prescribed in §§25.333(b) and 25.337, and the maneuvering load factors associated with probable 
inadvertent excursions beyond the boundaries of the buffet onset envelopes determined 
under$25.251(e), need not be exceeded. In addition, the entry speeds for flight test demonstrations at 
normal acceleration values less than 1 g must be limited to the extent necessary to accomplish a 
recovery without exceeding VDF/MDF.(f)In the out-of-trim condition specified in paragraph (a) of this 
section, it must be possible from an over speed condition at VDF/MDF to produce at least 1.5 g for 
recovery by applying not more than125 pounds of longitudinal control force using either the primary 
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longitudinal control alone or the primary longitudinal control and the longitudinal trim system. If the 
longitudinal trim is used to assist in producing the required load factor, it must be shown at VDF/MDF 
that the longitudinal trim can be actuated in the Airplane nose-up direction with the primary surface 
loaded to correspond to the least ofthe following Airplane nose-up control forces: 
e The Maximum control forces expected in service as specified in §§25.301 and 25.397. 
e The control force required to produce 1.5 g. 
e The control force corresponding to buffeting or other phenomena of such intensity that it is a strong 
deterrent to further application of primary longitudinal control force. 
25.1309 Equipment, Systems, and Installations 
a. The equipment, systems, and installations whose functioning is required by this Decree, must be 
designed to ensure that they perform their intended functions under any foreseeable operating 
condition. 
b. The Airplane systems and associated components, considered separately and in relation to other 
systems, must be designed so that- 
3. The occurrence of any failure condition which would prevent the continued safe flight and landing of 
the Airplane is extremely improbable, and 
4. The occurrence of any other failure conditions which would reduce the capability of the Airplane or 
the ability of the crew to cope with adverse operating conditions is improbable. 
c. Warning information must be provided to alert the crew to unsafe system operating conditions, and to 
enable them to take appropriate corrective action. Systems, controls, and associated monitoring and 
warning means must be designed to minimize crew errors which could create additional hazards. 
d. Compliance with the requirements of paragraph (b) of this section must be shown by analysis, and 
where necessary, by appropriate ground, flight, or simulator tests. The analysis must consider- 
5. Possible modes of failure, including malfunctions and damage from external sources. 
6. The probability of multiple failures and undetected failures. 
7. The resulting effects on the Airplane and occupants, considering the stage of flight and operating 
conditions, and 
8. The crew warning cues, corrective action required, and the capability of detecting faults. 
e. In showing compliance with paragraphs (a) and (b) of this section with regard to the electrical system 
and equipment design and installation, critical environmental conditions must be considered. For 
electrical generation, distribution, and utilization equipment required by or used in complying with this 
chapter, except equipment covered by Approved Technical Specification or Technical Standard Orders 
containing environmental test procedures, the ability to provide continuous, safe service under 
foreseeable environmental conditions may be shown by environmental tests, design analysis, or 
reference to previous comparable service experience on other Airplanes 
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f. EWIS must be assessed in accordance with the requirements of sec.25.1709. 
25.1329 Flight guidance system. 


g. Under any condition of flight appropriate to its use, the flight guidance system may not produce 
hazardous loads on the Airplane, nor create hazardous deviations in the flight path. This applies to both 
fault-free operation and in the event of a malfunction, and assumes that the pilot begins corrective action 
within a reasonable period of time. 
25.1585 Operating Procedures 
a. Operating procedures must be furnished for— 
3. Normal procedures peculiar to the particular type or model encountered in connection with routine 
operations; 
4. Non-normal procedures for malfunction cases and failure conditions involving the use of special 
systems or the alternative use of regular systems; and 
Emergency procedures for foreseeable but unusual situations in which immediate and precise action 
by the crew may be expected to substantially reduce the risk of catastrophe. 


b. Information or procedures not directly related to airworthiness or not under the control of the crew 
must not be included, nor must any procedure that is accepted as basic airmanship. 


The Responsibility for Aviation Regulation Directorate and Airworthiness Certification 


The Aviation Regulation is organized as a component part of the Ethiopian Civil Aviation Authority 
organized in different directorates with various responsibilities and functions. Aviation Regulation, Deputy 
Director General is entrusted by Director General ECAA to carry out all required functions among others in 
the area of airworthiness. It is also responsible for: Perform airworthiness related tasks associated with the 
registration of Airplane, Airplanetype certification acceptance based on FAA and/or EASA and/or Transport 
Canada..... 


1.17.16 Responsibilities of the Aviation Regulation in the Area of Airworthiness 


Develop and Propose amendment as appropriate, national airworthiness rules and standards, policy, and 
guidance, based on a continual review of the viability and effectiveness of those rules and standards , policy 
and guidance; Establish working relationships with other CAAs and industry that facilitate the certification 
of foreign aviation products and parts to enable their import and export; Perform regular surveillance and 
audits of industry activities to ensure compliance with airworthiness requirements and associated 
specifications: Evaluating changes to a certificate/approval to ensure continued compliance with the 
applicable airworthiness requirements 
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1.18 SUMMARY ON INTERVIEWS 


1. B737 CAPT. 
Have you trained crew ET302? 
- Accident PF was my student when he was in his initial training as FO on B737, after he became a Captain on 
recurrent training as well. 
How was your evaluation of his flying and checking skill? 
- As a captain he was very consistent and very serious in his performance, he had no problem at all. He 
knows his procedures, follows his SOP and on his personal character he is willing to work with all pilots. 
That is what I know about him: he was very good in CRM. When you say CRM there are 3 areas, Technical, 
procedural and interpersonal. 
Can you briefly describe the training program of ETH as an Airline? 
- After coming from pilot training you go through the ground school CBT and take examinations, when you 
pass you start your fixed base and you go through 11 sessions of full flight simulator, there after you go on 
observation flight and line training. There are some special classes like CRM, Indoctrination and other 
classes in between. 
Can you describe MAX difference training? 
- The MAX difference training was CBT training and it's around 6 hours training, maybe 8 hrs there was no 
simulation training for MAX at all except CBT training. 
Can you give us what elements discussed containing the difference? 
- The design of the A/C has some changes in the engine, on the A/C engine let's say it is bigger and has 
moved a little bit forward. Performance wise the T/OFF weight is higher than the 800 NG. 
There is initial requirement training about STAB TRIM control 

- [Initial training we have established procedures. I do exactly by the procedure 

How much line simulator and ground school was given to each one? 
- They should pass ground school before they come for Simulator training. 
- The training department introduced Runaway stabilizer on requirement training because it was not 
there. But once we get this AD it was additionally & necessary in the proficiency training. 

How were ET pilots notified of the AD and Boeing FCOM BULLETIN? 
Training department provides AD and BULLETIN to the pilots to see how to identify this Runaway stabilizer, 
altitude disagrees and IAS disagrees. There was no other procedure given. 


- We give digital updated data of charts and performance data of B737 A/C for pilots on the Logipad. 
How do you Know pilots have received data? 

- Will be checked with Logipad synchronization. Pilots will synchronize their Logipad application after 
return from flight or by policy they have to synchronize every 7 days. 
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- The pilots will find new data on what's new section of the Logipad. 
How do you know if someone has synchronized his Logipad in 7 days? 

- The Logipad system will produce reporting data. 
How do you know B737 released data has been disseminated? 

- The report will be released. Before every flight, pilots synchronize data by policy, unless some pilots are 7 
days away from home base. 


What actions are taken if synchronization is not done in 7 days? 


It will be reported to the chief pilot if synchronization was not done. - I have to look if there is a case that is 
not reported. Do you have awareness about B737 MAX AD if it was distributed? Yes we did and confirmed. 


2. Capt. 
Position - B737 NG/MAX pilot and Instructor 


- Can you describe What MAX difference training is? The MAX difference training is CBT training and it is 
around 2 hours training, maybe if you sit continuously on your laptop for 6 hrs. There was no simulator 
training at all. 


- What is the difference between MAX& NG -? 
The design of the A/C has some changes like MAX engine is bigger about 84" and moved a little bit forward, 
and Nose gear is extended up about 5.6" performance wise the T-OFF weight of MAX is higher than NG. 


- Can you give us Normal procedures from start of T-OFF to CLB? 


During T-OFF the Capt. will line up the A/C on the Runway, after completing the T-OFF checklist. Once the 
checklist is completed you get the clearance for T-off, Runway path is clear PF gives power to 4096 N1 by 
pushing TOGA and start take-off roll, PM calls 80Kt Auto call V1 then Rotate, PM calls positive rate PF 
commands GEAR UP. 

-What about Automation part? 

Engage A/P at 400ft RA the A/T will go to climb thrust ,LNAV or HDG select will be engaged and clean the 
A/C and Climb .To practice manual flight Climb to 10,000 ft manually if needed. Normally we encourage the 
pilot to minimize its workload to engage the A/P as early as possible. 

Can you tell us what IAS disagrees with? 

It is caused by a difference between captain and FO Air speed indicatorcaused by unreliable AOA signal. 
Over speed warning has a clacker sound and RED/BLACK tape on the airspeed indicator. This is caused by 
exceeding the design airspeed limit. 
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3. Capt 

Position - Training Manager, Qualification - ATPL Capt 

How do you hire pilots? 

After graduation we train CPL and MPL to FO on Q400 

B737 then will be promoted to captain after acquiring 3500 hrs. 

What is the training Package before being a pilot? 

Indoctrination, Duties and Responsibilities for 2 weeks, CBT 2 weeks then they go through FBT (fixed base SIM 
training) and FFS (full flight simulator). The syllabus also includes special courses. 


What is a Runaway stabilizer? 

Itis un-commanded stabilizer movement, 

It is similar to Runaway Stabilizer. We let all pilots know about it, incorporated in the SIM syllabus but no 
MCAS; we gave them only RUNAWAY STABILIZER situations added on recurrent Training. 

What Training syllabus was given about MAX from Boeing? 

There was a CBT course of 4 hrs long supposed to cover the difference between MAX and NG. There was no 
information about MCAS in the system. 

How do pilots confirm that they have received the AD? 

Pilots are required to update their LOGIPAD at least every 7 days; one of the briefings we do give is to 
comply with and our technical dept will follow up and remind us if any. Any improvement on training about 
the AD, We did send a letter to Boeing to confirm if itis enough but Boeing never answered. We initiated to 
work on RUNAWAY STABILIZER. 

Like any other person in this world I heard about MCAS .It is a pity to see signals coming from a single Angle 
of attack (АОА) could do this. They didn't even know about it. 

Pilots who flew the Accident A/C 

4. FO 

I was a FO on B737NG/MAX for 1.5 years. I have a total of 1000hrs. I flew the Accident A/C i.e. ET- AVJ from 
JNB- ADD on the same day of the accident. I flew this particular A/C 3 times total, everything was good, 
nothing unusual observed on the A/C and nothing was reported on the Logbook. There is some difference in 
the engine of the MAX and NG .The Nose gear height and the display units in PFD/ND have differences. 

We have taken training on Runaway Stabilizer; the stabilizer is controlled by Electrical Trim, A/P and 
manual trim. 

Crew who flew the accident A/C 

5. Capt. Position - Captain B737NG/MAX, 

І have been 7 years in the Air Line for approximately 7000 hrs with Ethiopian, TTL time 19000 hrs. 
Command time TTL 12000 hrs. I have TRI/TRE on EASA became B737-200/400. 
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In this accident the flight departed from JNB before the day of the accident. We arrived at ADD in the 
morning of the accident at 06:00LT.With this A/C we had no problem either Flight control or any other. The 
Logbook was clear with no remark. I flew this A/C 2 times in 2 days and had no problem. 

The difference training given about MAX is a Laptop training which is about 2 hrs. In this course we 
understood that there are differences between some systems like Size of the Engine which is 84" wide and 
moved a bit forward, the height of the nose gear about 5.6" high. 

A week before the accident I took simulator Training on the old simulator which is NG. I received training on 
Runaway Stabilizer which is a new training after the Lion Air accident. I actually did this training which has 
nothing to do with MCAS. 

The A/P engages by company policy at 500ft After T-OFF. When you press TOGA A/T is moving forward to 
give us the required thrust. If it is programmed in the FMC it will engage to climb thrust at 800ft AGL i.e. N1 
on the PFD FMA. The A/T is functional from start of T-Off to Landing flare. 

IAS disagree - Both on left and right PFD comes, which is Air speed unreliable either pitot or static ports or 
clogged the 2 air speed compare each other. 


Documentation 
Position- Senior Ground Instructor for 10 Years 


How do you provide the CBT class? 
There is a logipad feature uploaded by the engineers .There is a PayLess's feature i.e. Server You can learn 
online reading & understanding. 
What is your Dept. Role? 
- To update the course, assign & check if the trainee has done it and give the examination. 
To make sure they have good preparation before the Simulator schedule. 
Was there any Exam? 
- There were Questioners about the differences; unless you answer all will not let you go. 
- We made a B737 track about the progress in the online PayLess's. 
From the Department data both accident pilots took briefing about the AD and Boeing's BULLETIN. 
Do you know the accident pilots? 
- Yes I know them both. PF took the briefing by Flash. It was a 2 hours course. He did it on his Laptop and so 
did FO, same as the captain. 


LINE PILOTS of the B737MAX 

5. Capt. 

Training on MAX has its own CBT but I haven't been trained on the simulator, there is a difference in training 
issued by and I read it. I never did SIM training on the MAX. 


218 


Aircraft Accident Investigation Report B737- MAX 8, ET-AVJ December 2022 


We have STAB control on the Yoke & on the control stand. When needed operate electrically, A/P and 
manual. If the system gives uncommanded operation in the A/P say Runaway condition we operate the cut 
out Switch and stop the runaway condition. 

Over speed warning is a clacker and if the speed exceeds the Airplane design speed it clacks. 

Stick shaker is also a warning system before the A/C stalls. The system is designed to Alert the 

Pilot before actually stalls and stick shaker on both Yokes. 

A/P and A/T, to start from the A/P it gives relief for the pilot, can engage the A/P at 400ft after T-OFF. If it is, 
CAVOK recommends flying manually. 

A/T an important automation which will control the thrust levers depending on the requirement of the flight 
phase. A/T can engage on the ground during the flight and during landing. If you want to control manually, 
put the A/T off, itis after landing that you switch it off and the only time you do. 


6. Capt. 

Position Cap B737 NG/MAX and TRI/TRE i.e. DCP 

Experience TTL flying time -More than 10,000hrs of which 4000hrs is Captain. My duty as a line pilot is to 
take the flight from A-B safely considering weather, fuel & the progress of the flight. As an instructor 
teaching the Trainee's per the syllabus І have trained the accident FO Touch and GO training on the actual 
A/C and he was an average pilot. I flew with him 2 weeks before the Accident ADD-JNB-ADD. 

The accident flight captain we were intimate & never trained him. He was a very good Guy; only once or 
twice I have asked him to trade flights. Ethiopian Training syllabus is CBT based training depending on the 
experience of the pilot. The MAX training is 2 hrs CBT training and No Simulator training. 

We use Automation on high density airports as much as we can at 400ft RA engage A/P. If there is good 
weather we let pilots to fly manually to 10,000ft and engage A/P during training I let them fly both manual 
and with A/P and A/T. 


1.19 USEFUL OR EFFECTIVE INVESTIGATION TECHNIQUES 

The investigation was conducted in accordance with the EAIB approved Proclamation No 957/2016, EAIB 
Rules and Standards, policy and Procedures, and with the standards and recommended practices of ICAO 
Annex 13. 


2. ANALYSIS 

In accordance with Annex-13 and the EAIB Rules and Standards; the investigation committee assessed all 
the required data, the relevant records of FDR, CVR, ATS communication, test and researches, Boeing 
documents, including crew training and proficiency and other information collected and analyses done 
accordingly. 
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The analysis will also discuss the additional safety issues that were identified prior to the accident flight, 
such as Airplane design, Airplane certification, and organizational issues. 


2.1 Scenario of the Accident 


On this flight the captain was pilot flying (PF) and the first officer was the pilot monitoring (PM).Flight data 
recorder shows the left angle of attack (AOA) value became erroneous 10 seconds after rotation. This 
resulted in the onset of the stick shaker followed by a master caution light. At the same time the following 
happened on the captain's primary flight display (left PFD): 


е Indicated airspeed dropped from 170Kt to 156Kt 

e Flight director bar rapidly moved downward to 10? below horizon (-10°) 

е Red and black minimum speed band suddenly increased to 170 Kt, which was 9 Kt higher than the 
Airplane current IAS 

e According to the Manufacturer's system design and calculation theory, conditions were met for IAS 
DISAGREE and ALT DISAGREE alerts to appear, but they were not recorded on the FDR. 


As the IAS DISAGREE and ALT DISAGREE alerts were not recorded on the FDRno recording of crew 
conversation about the alerts, if they occurred as calculated by the manufacturer can also be attributed to 
the appearance of the master caution light which may have taken the crews attention to the glare shield and 
perhaps to the overhead panel momentarily in trying to identify what caused the master caution alert, and 
perhaps the alerts could have appeared at this time and by the time they turned their eyes to their 
respective PFD's the messages may have been there already. It should be understood that an alert is easily 
recognizable when it corresponds to a change of state like appearance or disappearance, change of colour or 
is accompanied by aural alert. 


With the onset of the stick shaker the captain initially responded by reducing the pitch which corresponds to 
one of the actions expected to be done by the pilot flying when a stick shaker triggers, as indicated in the 
approach to stall recovery manoeuvres stated in the quick reference hand book (QRH) ?5non-normal 
manoeuvres section of the B737. This reduction in pitch did not stop the stick shaker and proximity to the 


34 note in the QRH -Non Normal Manoeuvres "Approach to Stall or Stall Recovery" requests not to use the flight director commands 
during the stall recovery 
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ground or airplane handling quality which indicates the stick shaker to be erroneously activated probably 
led the captain to stop applying further nose down column input at a pitch angle of 7-8? above horizon. 


Approaching 400ft, the Captain called-out "command"attempted to engage the AP but it was not 
successful.At that time the FD pitch bars were out of view, this action, was not consistent with the 
procedure to be used with an ongoing stick shaker. As therewas no explicit discussion between the crew 
about using the autopilot, the investigation looked at two probable explanations for the above action. 


1. He was trying to apply with the non-normal situations guideline found in the flight crew training manual 
(FCTM) which states “when a non- normal situation occurs, the Maximum use of auto flight system is 
recommended to reduce workload". 


Approaching 400ft, the Captain called-out "command" and attempted to engage the AP but it was not 
successful. At that time the FD pitch bars were out of view. As there was no explicit discussion between the 
crew about using the autopilot, the investigation looked at two probable explanations for the above action. 


Further look at how training was conducted at the airline level for approach to stall recovery was conducted. 
Most approaches to stall training were given in accordance with the Boeing flight crew training manual 
FCTM guidelines. Per the manual all approaches to stall training were given with the autopilot engaged and 
the auto throttle disconnected to simulate an approach to stall condition and the pilot initiates recovery by 
disengaging the autopilot and following the steps in the approach to stall recovery procedure of the 
QRH. Additionally the investigation also observed that the FCTM doesn't have a guideline on how to conduct 
an approach to stall training with the autopilot not engaged nor for a stall condition during departure. 


Records at the airline show both pilots were trained in accordance with Boeing flight crew training 
guidelines. Thus, in all the training the pilot's received for an approach to stall condition, the crew would 
start recovery by disengaging the autopilot at the onset of stick shaker and the auto throttle was already 
disengaged prior to the training maneuver per the FCTM guideline. 


2. The crew understanding of the airworthiness directive and FCOM Bulletin that was released after the 
lion air accident. 


A thorough study was conducted regarding the airworthiness directive and the FCOM bulletin released after 
the Lion Air accident. The back ground information from the FCOM bulletin that calls for attention to "an 
AOA failure condition that occurs during manual flight only" was assessed during the investigation and 
was found that it creates confusing to the reader as it appears that the AOA failure condition would only 
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occur during manual flight only. But it was found that the AOA failure condition can occur regardless of the 
autopilot engagement status and that only activation of MCAS would be dependent on it. 


There might be a chance that the pilot perceived the bulletin in the above discussed manner and believed 
the problem would disappear given he engages the autopilot, and the reason for his repetitive attempt to 
engage the autopilot. A second attempt was made six seconds later, above 500 ft at this time the left hand FD 
pitch bar was at -10°. The Captain's reactions after the second engagement attemptper the CVR recording 
was "Yehe endet new" an Amharic expression meaning ("What's going on?") it was most likely ап 
explanation asking oneself when unusual and unexpected multiple happenings occur. His verbal expression 
supports his expectation that the autopilot should have engaged. Shortly afterwards, the Captain requested 
the FO to contact the radar controller. At this time the Airplane was climbing through 800 ft radio altitude. 


From take-off until the successful engagement of the autopilot on the third attempt, the airplane was kept in 
trim adequately by the Captain via the electrical trim command switches. The average force required on the 
control column was about 2596 higher than previous take-offs recorded on the FDR activation of the 
Elevator Feel Shift system in response to the erroneous AOA values. 


Passing 1000 ft/radio altitude, at the third attempt, the autopilot was successfully engaged. Just before the 
third AP engagement attempt, the pitch attitude was around 7?. The Captain's FD bars had been 
approximately centered for two or three seconds, which might have prompted him to try to engage the AP 
once more. On the FO's side, the FD pitch bar was 20?up. 


The crew were faced with unprecedented change of events shortly after lift-off where the workload is high 
even on a normal take-off. This significantly increased the crew workload. 


On several occasions, the captain asked the F/O to advise ATC of the inability to follow the planned 
departure due to flight control problem and to request runway heading and climb 14,000ft. It shows the 
captain has considered not resuming the normal flight and climb to the minimum safe altitude of 14,000ft 
around the airport to deal with the situation and decide on his next course of action. The heading mode was 
then selected on the mode control panel (MCP). 

During the time when the autopilot remained engaged, the left stall management yaw damper computer 
(SMYD1) which was affected by inputs from a failed left AOA sensor calculated the left hand minimum 


operational airspeed erroneously above 340kt (VMO). At the start of the airspeed clacker (05:41:21) over 
speed warning triggered,and the captain called "SPEED" to which the F/O responded "SPEED" 


Moreover, at that time, the auto throttle operation was affected by the erroneous left AOA sensor value so it 
remained in the Arm mode and failed to transition to N1 mode. Transition to the N1 mode would have 
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reduced the take-off thrust to the climb thrust automatically. The auto throttle did not give a warning or a 
failure flag for the flight crew when its operation was affected by the failed AOA sensor value. 


The first MCAS activation occurred within a second where the auto throttle was supposed to reduce from 
take-off thrust to climb trust. And in less than another second GPWS aural alert "DON'T SINK" sounded 
twice. 


The activation of MCAS followed by GPWS aural alert with already ongoing stick shaker coupled with no 
failure flag or warning from the auto throttle as it failed to transition to climb thrust in an extremely high 
workload environment must have caused the auto throttle remaining in the ARM mode with take-off thrust 
set to remain unnoticed by the crew.The manufacturer revealed during the investigation that the flight 
management system responsible for calculating and sending thrust command was affected by the erroneous 
AOA inputs. There was no flight crew document (FCOM,AFM, QRH...) that states this could happen. 


The erroneously calculated left hand minimum manoeuvring speed from the SMYD also gave the flight deck 
effects on the captain's airspeed indication in terms of colour and manoeuvring band that the airplane was 
at a dangerously low airspeed. But the number in the airspeed indicator kept increasing as the airplane 
pitches down. 


The pilot's attention was already consumed with multiple alerts and managing the flight path at the same 
time. The effect of airspeed indication giving the pilot two different warnings, i.e. dangerously low airspeed 
indicated by stick shaker, minimum maneuvering band above current airspeed versus high airspeed 
indicated by the numbers in the speed tape was a point of concern. Although a pilot would normally look at 
both the maneuvering band and the number in the speed tape and compare the two for his actions, in this 
particular flight multiple events have occurred simultaneously which has an effect on the pilot's cross 
checking. There is a high probability that the low speed feeling indicated by amber and red colour coupled 
with a stick shaker would weigh in the pilot's judgment compared to the number indicated in the speed tape. 


As a right turn was initiated after selected heading was changed to 197, the pitch decreased as a result of 
the combination of the nose-down command by the A/P and the right turn. This became visible on the 
vertical speed indicator which reached approximately -1 600 ft/mn. The red and black stripe band covered 
the speed tape entirely, which may have added confusion for the Captain. When the A/P disconnected, the 
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Captain stopped turning and tried to stop the nose down movement by pulling on the column. The Captain 
applied an increasing force between 50 Lbs and 75 Lbs?6on the control column towards pitch up. 


As the flaps reached the retracted position, MCAS activated for the first time and the stabilizer trim position 
decreased down from 4.6 to 2.1 units. Although the Captain was applying an increasing nose up force 
(between 100 and 125 Lbs), only a brief electric trim up input of 2 seconds was recorded, which was 
insufficient to trim out the MCAS inputs and to relieve the aerodynamic loads. The stabilizer remained at 
2.1 units of trim. This short input may be explained by the fact that typical activation (pilot's muscle 
memory) of the electric trim is usually around 2 to 3 seconds. 


It was noted that MCAS trim is very fast; however the pilot's inputs to re-trim to neutral were discontinued 
in the trim band range of 2.26 to 2.38 units ANU for some unknown reason and it was understood that the 
rapid onset and complexity of the emergency and its effect on the ET302 flight crew's actions. 


"Ensure that if MCAS is erroneously activated, the MCAS system preserves the flight crew's ability, using 
basic piloting techniques, to control the airplane after the activation." However when an erroneous АОА 
value (nose high) exists, MCAS continually activate airplane nose-down stabilizer trim with incremental 
commands (moves the stabilizer a fixed amount regardless of current position of the stabilizer) five seconds 
after each time the pilot tries to return to trimmed condition.?7 Hence, MCAS denies trim authority апа made 
it difficult to control the airplane from excessive nose dive and crashing. 


The eCAB participants noted that attempting to duplicate the ET302 flight crew actions, the simulator 
crews felt it was instinctual to use as much electric trim as needed to reduce column forces in response to 
MCAS inputs, recognizing that a sustained input on the electric trim switch was longer than typical inputs 
that pilots are accustomed to making during routine operations. The force applied by the Captain on the 
control column during this phase only allowed keeping the airplane almost level (around 8,900 ft). 


Five seconds after the pilot's trim input, MCAS activated a second time. Three seconds later, the GPWS aural 
"DON'T SINK" was triggered and the message "Pull Up" appeared in red on both PFDs. The Captain called 
"ARGEW CUT" a combination of Amharic and English languages which implies "cut it”. Before the first 
officer responded to this, the captain prioritized and repeatedly said “Trim...trim with me". The captain 
applied a 9 second electric trim-up input. This trim input fully counteracted the second MCAS input and 


°° simulator crews considered column forces above 60 Lbs to be high and above 80 Lbs difficult to maintain level flight 
? Summary of the FAA's Review of the Boeing 737 MAX « ensure if MCAS is erroneosly activated, the MCAS system preserves the flight’s crew ability, using basic 
piloting techniques, to control the airplane after activation » 
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stopped the GPWS warning even though it did not bring the aircraft to a neutral trim. It is because the 
activation of the MCAS made difficultto trim the airplane to the required level. 


According to the runaway stabilizer procedure; once a pilot identifies a runaway condition that did not stop 
with autopilot disengagement or one that starts during manual flight, he should immediately put the stab- 
trim cut-out switches to cut-out position in order to avoid further mistrim. Further trimming and bringing 
the aircraft to neutral would then be accomplished by the use of a manual trim wheel. Simulator experience 
and procedural knowledge has probably built confidence in the pilots' perspective in the application of the 
procedure and in maniplating the manual trim wheel. The FCOM's bulletins which addresses the erroneous 
activation of MCAS with the runaway stabilizer non-normal checklist with a note regarding the option to 
bring the aircraft to neutral by using the electric trim before moving the stab trim cutout switches to cut-out 
does not concur with the procedural steps of the checklist nor the training that has been conducted. It would 
then be instinctual for the pilot to apply the procedure as was during the training for runaway stabilizer.In 
this connection, one of the questions raised by the Airline, addressed to Boeing after the Lion Air accident, 
could have given a better guidance to pilots but unfortunately, Boeing refrained from providing explanation 
or clarification. 


In the meantime the FO recalled the captain's command and requested confirmation "stab trim cut out?" to 
which the captain agreed. The FO then moved the stab trim cut-out switches to cut-out. 


At this time, the stabilizer was at 2.3 units of trim and the Captain was pulling on the control column with a 
force of 80 Lbs. The altitude was 9 100ft, IAS 332 kt, pitch 295, and vertical speed * 350 ft/min. 


During abnormal situations, flight crews are assumed to be capable of maintaining control of the flight path 
and performing a rapid diagnosis that will allow them to identify the correct response and actions to apply. 
However, a significantly unusual abnormal situation can lead to a total loss of understanding. The stick 
shaker here represented a major disruption in managing the situation and the rapid onset of multiple 
inconsistent cues and abnormalities. As a consequence, the effectiveness the crew's CRM was seriously 
affected. 


Five seconds after the end of the Captain's electric trim-up inputs, a third automatic nose-down trim was 
triggered. There was no corresponding motion of the stabilizer since the stab trim cut-out switches were in 
cut-out position. At that moment, IAS was 327Kt, and on the F/O's speed tape, the speed trend indicated that 
the Airplane was expected to reach VMO within the next 10s. Seven seconds after the stab trim cut-out 
switches were set to cut out, the captain asked the F/O to pull up with him. The force applied on his controls 
was around 100 Lbs. From that moment on, the pitch varied between + 7 ? and - 2 ? (corresponding to 
variations ranging from + 4,400 ft / min to - 2,500 ft / min). The values increased when both pilots pulled 
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and decreased if only one pulled. The forces on the Captain’s control column varied between 90 and 110 lbs. 
The flight crew was struggling against the high column forces. 


Passing through 9500 ft (about 1900 ft above ground), the captain asked the FO to advise ATC that they 
wished to maintain "one four thousand feet" because they were having flight control problems and the F/O 
complied. 14,000ft was the minimum safe altitude around the departure airport. At that moment, the speed 
was reaching VMO and the airplane was climbing. The ATC communication congestion along with the stick 
shaker may have confused the F/O from detecting the excessive air speed at a key point. It seems the 
Captain wished to keep the navigation simple (runway heading) and to reach 14, 0006 (MSA) as а 
priority.The Captain's priority remained to control the airplane, which is in line with non-normal situations 
guideline in the B737 FCTM and the Ethiopian Airlines SOP regarding the prioritization of tasks in case of 
failure on board. 


The speed exceeded VMO 340Kt (varying between 360 and 375Kt). The over speed warning triggered. The 
captain said « THE SPEED » at the start of the airspeed clacker (05:41:21.) to which the F/O responded 
'SPEED' at 05:41:29. The uncontrollability of the airplane demanded extra ordinary physical and mental 
effort to be exerted by the crew. Repeatedly, the Captain asked the F/O to" pitch up with him". The force on 
the Captain's control was around 100lbs at that time sound of exhaustion and shortness of breath are heard 
on the CVR. 


The captain requested the F/O to try the manual trim wheel. After 4 seconds of intense efforts identified on 
the CVR, the F/O told the Captain "it's not working". At this moment the stabilizer trim was at 2.3 units?? the 
IAS at 340 Kt. 


FCTM indicates "Excessive airloads on the stabilizer may require effort by both pilots to correct the mis- 
trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual 
trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually". Forces 
needed to turn the trim wheel with such a mistrim and high speed are much higher than those expected to 
be encountered during training or in operation and likely would have required either a two-handed effort by 
one pilot, or a two-pilot effort.?? 


38A stabilizer of 2.3 units represents a -2,7? mistrim 
39Simulation and Trim Wheel Test Report $5DCA19RA101 the predicted trim wheel static force at the 340 KCAS / -1.5? mistrim condition is 
35 Ib. 
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The possibility of both pilots applying force on the manual trim wheel inorder to overcome the huge force 
that was required to turn the manual trim wheel was over ruled as it was found to be inconvenient as well as 
impractical due to the fact that the captain was holding the control column with a huge amount of force that 
required a two handed input to prevent the aircraft from diving. At different times during the event flight 
the captain was heard requesting assistance from his FO to pull with him as well. 


The effect of airspeed on the manual trim wheel operation was also observed in a level D simulator as well 
as flight control test rig (FCTR). It was noted in both assessments that at a high speed of 340Kt and lower 
speed of 220Ktwhile the same amount of mistrim is present and the captain pulling on the control column in 
an attempt to replicate the event flight, the manual trim operation was found to be extremely difficult even 
through one complete turn. It was also noted thatabout 40 turns were required to bring the aircraft to a 
neutral trim position. 


The significant amount of force required to turn the manual trim wheel was found to be the excessive 
airload on the stabilizer attributed to the force held on the control column to stop the aircraft from pitching 
nose down and dive rather than the airspeed maintained at that moment. 


This finding is also supported by a statement on the FCTM and simulator observations. The FCTM indicates 
the aircraft will accelerate and decelerate while accomplishing this technique indicating speed not to be a 
factor, and simulator observation has revealed the force required turning the manual trim wheel both at a 
high speed of 340Kt and lower speed of 220Kt was significantly high. 


The FCTM guideline on such excessive airloads is to relieve aerodynamically. Thus; inorder to relieve 
aerodynamically the pilot had to decrease the amount of force that was held on the control column. Whether 
relieving aerodynamically using the procedure commonly referred to as the "roller coaster method" was 
applicable to the event flight was addressed during the investigation. Prior to reaching the point where the 
flight crew tried to use the manual trim, the crew were already faced with significant aircraft pitching down 
caused by MCAS activation that has resulted in a GPWS terrain warning, and at the time the crew used the 
manual trim wheel the captain was holding the control column with a force of about 100Lbs. The FDR shows 
that at that moment the pitch varied between 7? and -2°with a corresponding variation on vertical speed 
between +4400ft/min to -2500 ft/min. The values increased when both pilot pull and decreased when one 
pilot pulled. 


The Captain repeatedly requested the F/O to pitch up with him "to go to 14 000", the F/O complied. 


The Captain asked the F/O to request from the ATC "a vector to return", and the F/O complied. Hence, at that 

moment, it seems the captain decided to return back for landing. However, during the radio communications 

between the АТС and the F/O, the Captain advised the F/O, to stand-by and pitch up with him to 14, 000 ft. 
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During the radio communications with the ATC, the F/O's action on the control column was released which 
increased forces on the Captain's control column. The Captain then requested the F/O to check the Master 
Caution. Then, they both announced "left alpha vane". The FDR data at that time is consistent with the crew 
pressing the Master Caution recall button to review the existing faults. This might indicate the captain 
probably wanted to reassess the faults and get to the root cause of the problem which started when they 
first had a master caution light right after lift-off. At this time the airplane was almost reaching the minimum 
safe altitude. After about 10 seconds the Captain's then told the F/O that they should pitch up together and a 
straining sound of both pulling on the control column is recorded on the CVR. The captain then told the FO 
"PITCH IS NOT ENOUGH" & "PUT THEM UP”. A sound similar to stab trim cut-out switches being returned to 
normal was recorded on the CVR, thus the stab trim cut out switches were most likely turned back on at 
that moment. After a failed attempt to trim using the manual trim wheel as per the runaway stabilizer non- 
normal checklist and significant and unbearable amount of force on the control column for the duration they 
held and the captain's last comment "pitch is not enough", It most likely appears that the flight crew were 
trying to find other means to relieve the force. The airplane was at 13, 800 ft level; IAS was 367kt, pitch just 
below 19, stabilizer at 2.3 units of trim, bank angle 21? right 


The crew was busy pulling on the controls with high muscular force trying to maintain airplane flight path 
control andreach 14, 000 ft, a target on which they remained focused. Trying to maintain flight path control 
was a very demanding task and represented here a high workload, physically and mentally, to the detriment 
of every other task. The over speed warning added another disruption and disturbance on board. The 
cockpit noise environment was unsettling and further impacted the flight crew's concentration. 


Immediately after the Stab trim cut-out switches being put back in normal position, the crew attempted 
another unsuccessful A/P engagement as the plane was approaching 14, 000Ғ. At the same time, the Captain 
applied two brief electric trim up inputs of 1 second each while pulling on the control with an average force 
of 100 Lbs. The force on the controls remained between 75 and 100 Lbs. Five seconds after the trim-up 
inputs, the fourth MCAS triggered. The plane started to descend. During the 9-second MCAS activation, the 
stabilizer decreased from 2.3 units to 1 unit of trim. The Captain repeatedly shouted to pitch up with FO. The 
forces were physically unmanageable by both flight crews. 


The airplane hit the ground eighteen seconds after the end of the 4% MCAS. 
2.2 Recorded Reports in the Maintenance Log Book 


The airplane's left Angle of Attack (AOA) Sensor failed immediately after takeoff sending faulty data to the 
flight control system. The erroneous data in turn triggered the Maneuvering Characteristics Augmentation 
System (MCAS) which repeatedly pitched the nose of the airplane down until the pilots lost control. 
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Intermittent flight control system abnormalities began well before the accident flight. Maintenance actions 
of relevance started occurring in December 2018 when the airplane was one month old and included several 
pilot write ups involving temporary fluctuations of vertical speed and altitude. There were also three 
reports of the airplane rolling during autopilot operation. Altitude and vertical speed indications on the PFD 
showed erratic and exaggerated indications. The airplane was only four months old at the time of its 
accident. 


From the maintenance log book report the airplane also suffered intermittent electrical/electronic 
anomalies in addition to the flight control system malfunctions. For example, three days before the crash the 
Auxiliary Power Unit (APU) Fault Light illuminated, and the APU had a protective shutdown. The APU is a 
backup electrical and pneumatic power source. The new Honeywell manufactured APUs on the 737 MAX is 
praised for having a more reliable starting capability. The onboard maintenance function computer message 
also indicated the Start Converter Unit (SCU) showed the APU's start system was inoperative. The SCU is 
located in the electrical and electronics (E/E) compartment. The Captain's personal computer power outlet 
also had no power. The possibility of intermittent electrical/electronic system defects were an underlying 
issue. 


From the above point of observation the AOA Sensor malfunction most likely occurred as the result of a 
power quality problem that resulted in the loss of power to the left AOA Sensor Heater. Evidence indicates 
the loss of power was likely due to a production related intermittent electrical/electronic failure involving 
the airplane's Electrical Wiring Interconnection System (EWIS) “апа the AOA Sensor part. Boeing delivered 
the ET302 airplane to Ethiopian Airlines on Nov 15, 2018. Within a month of being placed into service, the 
airplane started experiencing a variety of intermittent electrical and electronic malfunctions. 


According to the report, after the ET302 accident, Boeing informed the NTSB they had made an engineering 
design error in their initial AOA Sensor Hazard Analysis; Neither Boeing, the NTSB, nor the FAA informed 
Ethiopian authorities about this critical error that was communicated to the NTSB by Boeing four months 
earlier. 


A miscalibrated sensor scenario for JT610 and a bird strike scenario for ET302 cannot explain the flight 
control system alerting, maintenance messages and electrical/electronic system faults that were occurring 
on these airplanes in the weeks and days before their accidents. These accidents were triggered by 


44) s. Title 14 Code of Federal Regulations (EWIS) 
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production quality defects that presented as intermittent system malfunctions. These types of defects are 
difficult to identify and troubleshoot. They frequently result in No Fault Found maintenance determinations. 


MCAS and the lack of pilot training did not trigger these accidents; however it was the failure of the sensors 
due to the production quality defects. Simply put, if the intermittent defects did not cause the AOA Sensors 
to fail on these flights, MCAS would not have activated, and these two accidents would not have occurred. 
The MCAS would have remained as hidden threat until its true nature is exposed by some other valid or 
erroneous causes. 


2.3Crew Resource Management 


Crew Resource Management (CRM) refers to the effective use of all available resources: human resources, 
hardware, and information. These activities include communication, problem solving, and decision making, 
maintaining situational awareness, workload management, and dealing with automated systems. 


The guidelines for handling a non-normal situation, according to the Non-Normal Operation chapter in the 
FCTM, are recognition of non-normal conditions, maintain Airplane control, analyze the situation, take the 
proper action, and evaluate the need. 


During the event flight the crew was faced with multiple alerts and flight deck effects just 10 seconds after 
lift-off. The unprecedented events that unfolded were during a high workload time and very close to the 
ground. Maintaining airplane control was affected right from the first MCAS activation which happened at 
about 800ft above ground level. Per the non-normal situations guideline, airplane control was the first 
action to be accomplished by the pilot flying. For the majority of the event flight the captain was trying to 
control his aircraft as MCAS made it harder and harder for him to control. The flight crew's attention was 
consumed by the repetitive nose down commands from MCAS, terrain alert and the desire to climb to a safe 
altitude.The sudden and unexpected change in the situation right after takeoff, and the distraction due to 
high noise level (stick shaker, and associated aural warnings) in the cockpit coupled with the 
uncontrollability of to control the airplane affected the effectiveness of their CRM. 


Pilot flying workload and task demand were high when attempting to maintain flight path as column force 
increased with MCAS activation. Simulator crews considered column forces above 60lbs to be high and 
above 80lbs very hard. It became difficult to find a neutral column and maintain level flight. For reference, 
after the autopilot disengagement, the ET302 captain experienced column forces on average above 
90lbs. Column loads about 60-80 lbs were hard to differentiate - all are "high". The workload appeared to be 
high, and it was deemed a "demanding task" by the crew to maintain flight path control. It was noted that the 
stick shaker was a distraction when managing the emergency. 
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2.3.1 Crew Communications 


Crew communication seemed normal and standard for majority of the flight but some expected call outs and 
conversations did not occur between the crew after the onset of the sticks shaker. This can be attributed to 
the nature of the events that followed after the stick shaker which caused the flight deck environment to be 
noisy, that was made worse by chattering from ATC and other airplanes. Different failures and flight deck 
warnings occurred in a row with only few seconds in between. 


The CVR recording shows that after the crew performed the runaway stabilizer non-normal procedure and 
put the stab trim to cut-out; the captain asked the first officer what caused the master caution earlier and 
asked him to do a master caution recall. After which they both announced "left alpha vane". It looked like 
the captain wanted to reassess his actions and get to the bottom of things but was quickly distracted by the 
huge amount of force he was holding and told the first officer "pitch is not enough" and requested the FO to 
assist him with pitch. 


2.3.2 Flight Crew Situational Awareness 


Flight crew situational awareness and ability to perceive each and every thing to the detail was greatly 
affected with the ever changing flight scenario and unsettling warnings and flight deck effects. Flight 
instrument display of high speed indication with low speed warning was one of the main events ofthe flight. 
The flight crew's attention to speed and energy state of the airplane was greatly affected as their primary 
action of controlling the airplane per the non-normal situations handling guideline was not completely met 
as activation of MCAS repeatedly changed the flight path. 


During abnormal situations, flight crews are assumed to be capable of maintaining control of the flight path 
and performing a rapid diagnosis that will allow them to identify the correct response and actions to apply. 
However, a significantly unusual abnormal situation can lead to a total loss of understanding and defeat this 
principle. The stick shaker here represented a major disruption in managing the situation and the rapid 
onset of multiple inconsistent cues and abnormalities since take-off impacted the crew's ability to perceive 
the situation. The crew was in an unprecedented situation. Records at the airline level show that the crew 
had received training in accordance with Boeing guideline in the FCTM. In the event flight the pilot's 
attention was consumed with multiple alerts and managing the flight path at the same time. The effect of 
airspeed indication giving the pilot two different warnings, i.e. dangerously low airspeed indicated by stick 
shaker, minimum manoeuvring band above current airspeed versus high airspeed indicated by the 
numbersin the speed tape could have confused the crew. 
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2.3.3 Decision Making 


During the event flight the captain asked the first officer to request runway heading due to flight control 
problems. It is noted that the captain understood it would not be possible to fly the original clearance of 
standard instrument departure and make the navigation simple allowing more time for him to decide on the 
next course of action. 


The captain also asked the first officer to request a stop climb at 14,000ft which is the minimum safe altitude 
around the departure airport. This was an indication that the captain understood it would not be possible to 
continue the normal climb profile and needed to level off at the lowest safe altitude in order to set things in 
order and decide on the next course of action. 


After the second MCAS activation, the captain asked the first officer to trim with him and then put the stab 
trim cut-out switch to cut-out. The first officer confirmed with the captain and performed the procedure as 
per the AD and FCOM bulletin. 


After a failed attempt to use the manual trim wheel and trim the airplane as per the runaway non-normal 
procedure and the training they have acquired, the captain decided to return back for landing and asked the 
first officer to get radar vectors for landing. 


During the right turn for radar vectors, the captain who had been holding the aircraft with tremendous force 
for quite some time told the first officer "pitch is not enough", "put them up". The FDR and CVR data was 
concurrent with the stab trim cut-out switch being returned to normal position. Even if the decision to 
return the stab trims cut-out switches back to normal was not consistent with the AD nor the FCOM 
bulletin,it seems the captain understood that the force required on the control columns was beyond one he 
and his first officer could sustain for the remainder of the flight until a successful landing from the radar 
vectors. 


Simulator observation and research during the investigation process has shown that an attempt to land with 
the miss trim level they have on the event flight where the stab trim switches were in cut-out position was 
unsuccessful. 


2.4FCTR Evaluation 


The Boeing constructed FCTR is designed to replicate the forces needed to move the trim wheel in a 
B737MAX at various mis-trim and airspeed combinations. A mis-trim of -1.5 units at airspeed of 340 KCAS 
(VMO) was the most difficult mis-trim/airspeed combination available in the FCTR. But during the accident 
flight, the mis-trim was -2.7 units at airspeed of 340 KCAS. 
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It was observed that the greater the mis-trim value, the greater the force required by the pilot on the control 
column to fly level flight and consequently the greater the force required rotating the manual trim wheel. 


The trim wheel must complete 15 revolutions to move the stabilizer by 1 unit (degree) of trim. 
Consequently, to resolve a mis-trim of -1.5?, the wheel would have to be rotated through 22.5 revolutions; 
but to resolve а mis-trim of -2.7? it would have to be rotated through 40.5 revolutions, i.e., 8096 more. 
Initiating rotation and continuing for 40 revolutions on the accident flight would have been significantly 
more difficult than in the FCTR. 

According to the cockpit voice recorder (CVR), the first officer indicated that he could not rotate the manual 
trim wheel. Moreover, Simulator and FCTR observations have revealed that the force required to operate the 
manual trim both at 340Kt and 220Kt was significantly high. 


The force required to rotate the trim wheel depends on grip (overhand or underhand), seat (body) position 
in relation to the trim wheel, and the position of the handle on the wheel (which would change the direction 
of the force vector required to initiate or maintain rotation) could all affect how easy or difficult it was to 
move the manual trim wheel handle. Moreover, there was no mention of high forces that may be required to 
trim manually in either the QRH or the Boeing FCOM. Excessive air loads on the stabilizer may require effort 
by both pilots to correct the mis-trim. In extreme cases it may be necessary to aerodynamically relieve the 
air loads to allow manual trimming. 


Therefore, the force required to correct the mis-trim of -2.7 was out of the acceptable capability of the crew. 


2.5Flight Crew Training and Proficiency 


The existence of MCAS and its function was not disclosed in any of the manuals provided by the 
manufacturer. Without MCAS description, function and its effect, it would be more difficult for the flight 
crew to understand the complexity. Instead of focusing on the runaway stabilizer in the AD, the crew would 
have been served better if training was provided about the effect of MCAS activation. With better 
understanding of the system the crew would have had better chances of mitigating the consequences of 
repetitive MCAS activations. 


The investigation found that the Captain's priority remained to control the airplane, which is in line with 
non-normal situations guideline in the B737 FCTM and the Ethiopian Airlines SOP regarding the 
prioritization of tasks in case of failure on board.The operator owns training manual which is approved by 
Ethiopian Civil Aviation Authority. According to this manual the accident pilot and first officer had taken the 
type rating, recurrent training, line check and proficiency check as it is clearly put in the Ethiopia civil 
aviation Rules and standards (ECARAS) Part 2, part 8 and part 9 and the operation training manual of the 
company. 
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Ethiopian Civil Aviation Authority based on ICAO Doc 8335, Manuals of procedures for operation inspection, 
Certification and continued surveillance conducts an oversight of the operator using inspector procedure 
hand book and audit policy manual for the compliance of ECARAS part 2, part 8 and part 9 Ref Operation 
Inspector Handbook chapter 1-06 Annual Inspection Program, chapter 4-08 training program Inspections, 
chapter 4-07 Training and Qualification Record inspection. 


The PF and FO had taken proficiency checks on 30 November 2018 and 03 December, 2018 respectively and 
completed successfully. The accident crew has taken the MAX difference training in a 2 hour CBT training 
which was recommended by the manufacturer and approved by the regulators. 


The CBT training recommended by the manufacturer and approved by regulators was made available to the 
pilots through the Airline's Logipad application on designated computer devices to each pilot. The Logipad 
application has the additional function of the training process and evaluation. (Learning Management 
System) 


Logipad is also used to distribute manuals, Notices and Bulletins, other training and evaluation as well as 
aircraft performance calculations and reports. Boeing OMB and FAA AD were distributed to all pilots of the 
operator on the MAX fleet through the Logipad application. The Airline's policy requires that each flight 
crew member synchronizes his/her Logipad prior to each flight and as a minimum every seven days. 


2.6FAA'sAirworthiness Directive and Boeing's Bulletin 


After the Lion air accident on October 29*^ 2018, the manufacturer released bulletin ETH-12 on November 6, 
2018 was incorporated on the Ethiopian airlines FCOM showing as in effect. The document clearly states 
that information in the bulletin is recommended by the manufacturer but may not be FAA approved at the 
time of writing. In the event of conflict with the FAA approved Airplane flight manual (AFM), the AFM shall 
supersede. 

On November 7, FAA released emergency airworthiness directive AD #: 2018-23-51 for owners and 
operators of the Boeing company model 737-8 and -9 Airplanes. Both the FAA's AD and the manufacturer's 
bulletin were not updated or a revision was released after their initial release in November. The AD states 
that itis an interim action and if final action is later identified, FAA might consider further rule making then. 
The AD was presented in 10 parts labeled from (a) to (J). Part (e) unsafe condition: states that the AD was 
prompted by analysis performed by the manufacturer. Part (h) is AFM revision and it updates the operating 
procedures in the AFM. 
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(һ) AFM Revision: Operating Procedures 


Within 3 days after receipt of this AD, revise the Operating Procedures chapter of the 
applicable AFM to include the information in figure 2 to paragraph (h) of this AD. 


Figure 2 to paragraph (h) of this AD — Operating Procedures 


Required by AD 2018-23-51 


Runaway Stabilizer 

Disengage autopilot and control airplane pitch attitude with control column 

and main electric trim as required. If relaxing the column causes the trim to 

move, set stabilizer trim switches to CUTOUT. If runaway continues, hold 

the stabilizer trim wheel against rotation and trim the airplane manually. 
Note: The 737-8/-9 uses a Flight Control Computer command of pitch 
trim to improve longitudinal handling characteristics. In the event of 
erroneous Angle of Attack (AOA) input, the pitch trim system can trim 
the stabilizer nose down in increments lasting up to 10 seconds. 


Looking at part (h) of the AD, the phrase "if relaxing the column causes the trim to move, set stabilizer trim 
switch to CUTOUT." assumes that there is a possibility for the runaway to be stopped by applying opposite 
control column force. This same phrase is not present on the manufacturer released bulletin which clearly 
shows that the manufacturer is aware of the fact that the control column mounted cutout is not effective for 
this specific scenario. 
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Assessment of Contents of the Bulletin: 


Quemar mer 


Flight Crew Operations Manual Bulletin 
for 
Ethiopian Airlines 


The Boeing Company >- 6 - 
Seattle, Washington 98124-2207 a. d 


Number: ETH-12 
IssueDate: November 6, 2018 


Airplane Effectivity: 737-8 / -9 


Subject: Uncommanded Nose Down Stabilizer Trim Due to Erroneous Angle of 
Attack (AOA) During Manual Flight Only 


Reason: To Emphasize the Procedures Provided in the Runaway Stabilizer Non- 
Normal Checklist (NNC). 


Information in this bulletin is recommended by The Boeing Company, but may not be FAA approved 
at the time of writing. In the event of conflict with the FAA approved Airplane Flight Manual 


(AFM), the AFM shall supersede. The Boeing Company regards the information or procedures 
described herein as having a direct or indirect bearing on the safe operation of this model airplane. 


THE FOLLOWING PROCEDURE AND/OR INFORMATION IS EFFECTIVE UPON RECEIPT 


Background Information 


The Indonesian National Transportation Safety Committee has indicated that 
Lion Air flight 610 experienced erroneous AOA data. Boeing would like to call 
attention to an AOA failure condition that can occur during manual flight only. 
This bulletin directs flight crews to existing procedures to address this condition. 


In the event of erroneous AOA data, the pitch trim system can trim the stabilizer 
nose down in increments lasting up to 10 seconds. The nose down stabilizer trim 
movement can be stopped and reversed with the use of the electric stabilizer trim 
switches but may restart 5 seconds after the electric stabilizer trim switches are 
released. Repetitive cycles of uncommanded nose down stabilizer continue to 
occur unless the stabilizer trim system is deactivated through use of both STAB 
TRIM CUTOUT switches in accordance with the existing procedures in the 
Runaway Stabilizer NNC. It is possible for the stabilizer to reach the nose down 
limit unless the system inputs are counteracted completely by pilot trim inputs 
and both STAB TRIM CUTOUT switches are moved to CUTOUT. 
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In the back ground information of the bulletin, it states that: 


"[n the event of erroneous AOA data, the pitch trim system can trim the stabilizer nose down in increments 
lasting up to 10 secondis......... 

Repetitive cycles of commanded nose down stabilizer continue to occur unless the stabilizer trim system is 
deactivated through the use of both STAB TRIM CUTOUT switches in accordance with the existing procedure 
in the runaway stabilizer NNC." 


As this feature of the pitch trim system is very new information to the FCOM, pilots or the operators, there 
should have been some description or statement that would explain why the pitch trim system would trim 
the nose of the airplane down repetitively and what this specific part of the pitch trim system considers as a 
precondition in order to activate. 


After the Lion Air accident, the manufacturer revealed this feature of the pitch trim system as MCAS, and 
provided description of it to operators, including Ethiopian Airlines. At the time of the Ethiopian accident, 
the main body of the FCOM had not yet been updated by Boeing to include the information provided in the 
ОМВ. From the conditions that must be met to activate this feature of the pitch trim system (MCAS), one 
condition is repeatedly stated in the bulletin as "During manual flight only”. In fact the bulletin gave so 
much attention to this very condition that it is written in bold wherever it appeared on the document but 
the other precondition that must be met like the position of the "FLAPS" was not mentioned. 

It should be understood here that MCAS would never have activated the repeated nose down trim if the flaps 
were still left down, even in the presence of erroneous AOA. This crucial information was never revealed in 
the bulletin or in the airworthiness directive. 


ASSESSMENT OF THE BULLETIN FROM THE CONTENT 


The statement in the back ground of the bulletin gives unclear information: 


Background Information 


The Indonesian National Transportation Safety Committee has indicated that 
Lion Air flight 610 REPERI erroneous АО. data. aa коша се! to call 
attention to an AOA 1 ге conditi à | ir during manu: only. 
This bulletin directs flight crews to eue тта to “address this condition. 


The above highlighted phrase in the back ground information “calls attention to an AOA failure condition that 
can occur during manual flight only”. Actually, an AOA failure can occur in either manual or autopilot flight. It 
is the activation of MCAS which is dependent on the status of autopilot engagement, not only the failure of 
AOA. 
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Non- Normal Checklist 


The indications stated in the bulletin of erroneous AOA are related to different checklists. But the bulletin 
instructs the pilot to do the runaway stabilizer NNC for this indication and does not mention any other 
checklist. 

FDR data has revealed that the erroneous AOA signal has caused many failures to happen at the same time. 
When multiple failures occur all together, addressing only one failure scenario would not be enough to 
handle the situation, but the operational information section of the bulletin tried to direct in handling the 
situation with only Runaway stabilizer non-normal checklist. 


As can be observed above, there was a possibility for the existence of confusion in understanding the failure 
scenario as well as in interpreting the operating procedures. 


The investigation team did a survey on how this bulletin was perceived amongst pilots and the operator 
during interviews held with pilots, instructors and training department of the airline. It was discovered 
through this process that the airline had concerns about the interpretation of the bulletin and this concern 
was relayed to Boeing as early as November, 2018. An email correspondence between the operator and the 
manufacturer was also gathered through this process. From the email correspondence, the following were 
questions raised by the operator on 28 November 2018, quoted: 


"Having attended the Boeing briefing on the 27th of November, held on a teleconferencing, and after mulling 
on the very precarious situation where the lion air crew was, we have come up with few questions mainly 
related to operations. The questions are summarized as follows: 


First; According to the briefing there was no problem with the MCAS system at the time of the accident 
except being triggered at the wrong moment during the flight due to a single erroneous AOA data. Then why 
is the system designed in such a way that it operates depending on a single data source, especially when it is 
of a serious consequences, instead of interrogating data from other AOA sensors? 


Second; any average skilled pilot experiencing multiple failures, as it were, would react to the abnormalities 
depending on their sequence of urgency starting with a stick shaker. All simulator trainings, so far provided, 
require at the first activation of a stick shaker to react in such a way to curb the impending actual stall. It is, 
though, obvious that all stall warnings are not true as was the case with the Lion Air 737 MAX involved in 
the accident, but once a pilot identified a stick shaker to be a nuisance, the next thing he would do is the 
AIRSPEED UNRELIABLE memory item not runaway stabilizer checklist. Because the AIRSPEED 
UNRELIABLE checklist puts a nuisance stick shaker to be an indication of unreliable airspeed, a pilot can't be 
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expected to put the trim cut out switches to cut out before dealing with the above procedures unless there is 
a clear guidance or a QRH procedure addressing such scenario. 


Third; the third question has to do with the very checklist recommended by the bulletin issued regarding the 
MCAS system and that is the RUNAWAY STABILIZER checklist. This checklist commands the pilot to put the 
stab trim cut out switches to cut out only if the runaway continues after the autopilot is disconnected and 
that is not the case with MCAS. MCAS does not continually trim down. It stops trimming, according to the 
bulletin, for 5 seconds if the control column trim switches are trimmed in the opposite direction. That will 
rule out the attempt to categorize the malfunction, if it is, as a runaway stabilizer and by implication the use 
of the checklist what is the delineation between an MCAS normal operation and runaway stabilizer?" 


The manufacturer responded on 3 December 2018: declaring "I am happy to hear that you were able to take 
part in the Fleet Team meeting and will attempt to answer other questions from your pilots. However, 
because of our Annex 13 technical support to the [on-going Lion Air] accident investigation, we are unable to 
answer questions directly related to this event. I can only address the current system and the Operation's 
Manual Bulletin. The first two questions directly relate to the accident scenario; therefore, I will be unable to 
address them here. I have provided the answer to the third question below". 


[Text of question 3 repeated in response]"The purpose of the Operations Manual Bulletin is to raise 
awareness of the relationship between an erroneous AOA indication and uncommanded stabilizer 
movement. Specifically, if the AOA is erroneous and also high, it may be high enough to trigger the MCAS 
flight control law. The pilot always has trim authority to override both the Speed Trim and MCAS flight 
control laws with the control wheel electric trim switches and ultimate authority to power off the entire 
stabilizer trim system using the Stabilizer Cutout Switches. As is stated in the OMB, if uncommanded 
stabilizer trim movement is experienced in conjunction with the erroneous AOA flight deck effects, the 
instructed course of action is to use the Stabilizer Cutout switches per the existing procedure. Additionally, 
in all phases of manual flight, it is expected that flight crews would use normal trim procedures to trim out 
undesired control forces or positions, regardless of axis - stabilizer, rudder, or aileron." 


As seen above the concerns raised by Ethiopian airlines about task and checklist prioritization were not 
answered by Boeing stating they relate to an ongoing investigation. If this concern was addressed in time, 
the effect it would have on the Ethiopian airlines accident flight can not be overstated. 
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2.7Ethiopian Safety Management System (FCOM Bulletin & MOM Handling) 
The Chief Executive Officer (CEO) is responsible for the overall safety of Ethiopian Airlines. 


The Accountable Manager (the Chief Operating Officer-COO) is responsible for implementing safety 
standards and resolving operational safety issues. This responsibility includes the authority to establish 
support for the program in each operational unit. Responsibility for further implementing the Safety 
Program in all divisions rests with respective vice Presidents and their designate. 


2.8 ORGANIZATIONAL ISSUE 
2.8.1 ECAA Regulation and Certification 


Referring to Ethiopian Civil Aviation Rules & Standards Part 5 - Airworthiness, section 5.2.1.5 Acceptance of 
Type Certificate every Airplane, Airplane engine, and Airplane propeller designed and produced overseas 
and imported into Ethiopia must obtain a type certificate acceptance. The Civil Aviation Rules & Standards 
(ECARAS Part 5 -Airworthiness regulates the compliance procedure for the Ethiopian Civil Aviation 
Proclamation 1179/2020 and it is outlined in the Ethiopian Civil Aviation Authority's Airworthiness 
Inspector Handbook Part 2, Chapter 2-27 Type Certificate Acceptance process (Airplane , Engine and 
Propeller). 

After the Lion air accident on October 29% 2018 the FAA released an AD that required revising certificate 
limitations and operating procedures of the Airplane flight manual (AFM) to provide the flight crew with 
runaway horizontal stabilizer trim procedures to follow under certain conditions. 

Accordingly the ECAA issued AD 2018-23-51 dated 08 Nov, 2018 which was released by FAA on November 
07, 2018 applicable for 737 MAX-8, 9 Airplanes. The operator was advised to revise its AFM and operating 
procedures. The ECAA advised the operator implementing the AD and reported to the authority within the 
specific time provided and this was confirmed by the operator response that has been done accordingly. 
Even though the FAA's AD released after five months of the lion air accident the content of the AD was 
symptomatic of only a runaway stabilizer. 

Then after, the ET 302 accident on 10 March, 2019 the Ethiopian Civil Aviation Authority as per ECARAS 
part 8, section 8.2.1.2 (a) notified that the Ethiopian Airlines Group that all Boeing 7373MAX-8 fleet of 
Airplane grounded and was not allowed to make commercial flights effective March 11, 2019. 
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2.9MCAS Design, Description and Certification, 


The 737 MAX 8 is a derivative of the 737-800 Model and is part of the 737 MAX families (737 MAX 7, 8, and 
941). The 737MAX incorporated the СЕМ LEAP-1B engine, which has a larger fan diameter and redesigned 
engine nacelle compared to engines installed on the 737 Next Generation (NG) families. Because the 737-8 
is a derivative of the 737-800 model, its certification basis, which was established per 14 CFR 21.101 
Changed Product Rule, required Boeing to demonstrate compliance with part 25 as amended by 
Amendments 25-0 through 25-137, plus amendment 25-141 with exceptions permitted by 14 CFR 21.101for 
significant areas of change at the product level and those areas affected by the significant product level 
change. 


During the preliminary design stage of the 737 MAX 8, Boeing tests and analysis revealed that the addition 
of the LEAP-1B engine and associated nacelle changes produced an Airplane nose-up pitching moment 
when the Airplane was operating at high angles of attack (АОА) and mid Mach numbers. This nose-up 
pitching moment was deemed likely to affect the stick force per g (FS/g) characteristics required by FAR 
25.255 and the controllability and maneuverability requirements of FAR 25.143(f). After the study of 
various options for addressing this issue, Boeing implemented aerodynamic changes as well as a stability 
augmentation function called the Maneuvering Characteristics Augmentation System (MCAS), as an 
extension of the existing Speed Trim System (STS), to improve Airplane handling characteristics and 
improve static longitudinal stability at elevated angles of attack. 


The AD issued following the Lion Air crash indicates that if one executes the Runaway stabilizer NNC the 
problem could be handled. However, the information about flap position as part of the MCAS logic was 
omitted from the AD,MCAS operates only when the flap was fully up. Following the issuance of this AD, 
certain MAX crew members asked clarification from Boeing via email whether they should do airspeed 
unreliable procedure first regarding certain aspects of the AD. The response they got was that Boeing could 
not make further comments as the case was under investigation, but later on Boeing answered some of the 
questions. 


41Both the 737-8 and 737-9 were in service at the time of the accident. The 737-7 and 737-10 are planned future derivatives that have not 
yet entered service. 
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2.9.1 MCAS Description in FCOM 


Boeing and the FAA engaged in extensive discussions about the appropriate content of MAX training and 
manuals for a period of several years prior to MAX certification in 2017. During discussions and 
communications with the FAA in 2016, Boeing proposed removing MCAS from the FCOM and the FAA 
agreed with that recommendation. 

FAR 25.1585 provide direction for the content of Airplane operating procedures, such as the AFM.FAR 
25.1585(b) states that "Information or procedures not directly related to airworthiness or not under the 
control of the crew must not be included, nor must any procedure that is accepted as basic airmanship." As 
relevant to this standard, Boeing's rationale for recommending MCAS's removal from the FCOM included 
that: (1) the MCAS function is automatic and operates in the background, without any control input from the 
flight crew and 

(2) Crews were not expected to encounter MCAS in normal operation. 

The investigation assessed documents that Boeing with its knowledge did not mention about MCAS; instead 
they were telling and emphasizing only the runaway stabilizer/un-commanded stabilizer to the operator 
and for the authorities.There was CBT training for a few hours long supposed to cover the difference 
between MAX and NG. There was no information about MCAS description in the system except the Airplane 
has wide and moved a bit forward body, Size of the Engine which is 84" and the height of the nose gear 
about 5.6" high. 


2.9.2 Functional Hazard Assessment 


During the process of developing and validating the Functional Hazard Analysis (FHA), Boeing considered 
four failure scenarios including uncommanded MCAS function to the Maximum authority limit of 2.5? of 
stabilizer movement. The uncommanded MCAS function to Maximum authority was flight simulated to high 
speed Maximum limit of 0.6?, and also the low speed Maximum limit of 2.5? of stabilizer movement and 
Boeing did not test repetitive erroneous MCAS activations in a flight simulation, but did consider the 
possibility of an erroneous AOA sensor potentially leading to repeated MCAS activations. 


The specific failure modes that could lead to uncommanded MCAS activation, such as an erroneous high 
single AOA input to the MCAS, were not simulated as part of these functional hazard assessment validation 
tests. As a result, additional flight deck effects such as IAS DISAGREE and ALT DISAGREE were not assessed. 


The unintended MCAS-commanded stabilizer movement due to erroneous single AOA input was considered 
a failure condition with Major effect in normal flight envelope. However, this classification did not consider 
the possibility of the increased workload associated with the additional flight deck effects. 
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MCAS was activated without pilot input and only operated in manual, flaps up flight. The system is designed 
to allow the flight crew to use column trim switch or stabilizer aisle stand cutout switches to override MCAS 
input. The function is commanded by the Flight Control computer using input data from sensors and other 
Airplane systems. 


The major classification used by Boeing indicated a remote probability of this hazard occurring and that it 
could result in reduced control capability, reduced system redundancy, or increased crew workload. Other 
classification categories include "Minor," "Hazardous," and "Catastrophic." Because uncommanded MCAS 
function was considered "Major," Boeing did not perform a specific fault tree analysis for an uncommanded 
MCAS hazard. 


Retention and delegation are accomplished with respect to compliance deliverables not to specific functions 
i.e MCAS itself would not be delegated to the ODA. 


Consistent with the FAA authorization, the FAA has discretionary authority as to what is reviewed, whether 
submitted directly to the FAA for review and approval by an applicant or submitted by a designee or ODA 
recommending approval. 


When delegating at the end of a program, there has been some level of FAA involvement and the delegation 
confirms that the designee should make the final approval. 


In all cases, delegation is not accomplished by a single individual but follows a structured review process. 


2.9.3 FHA for MCAS Related Failures 


The investigation reviewed sections of Boeing's 737 NG/MAX Stabilizer Trim Control System Safety Analysis 
that pertained to MCAS. Boeing's analysis included a summary of the functional hazard assessment findings 
for the 737 MAX stabilizer trim control system. For the normal flight envelope, Boeing identified and 
classified two hazards associated with "uncommanded MCAS" activation as "major". The major classification 
used by Boeing indicated a remote probability of this hazard occurring and that it could result in reduced 
control capability, reduced system redundancy, or increased crew workload. Other classification categories 
include “Minor,” "Hazardous," and “Catastrophic.” Because uncommanded MCAS function was considered 
"Major," Boeing did not perform a specific fault tree analysis for an uncommanded MCAS hazard and failed 
to classify MCAS as a safety-critical system, which would have attracted greater FAA analysis during the 
certification process. 
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The specific failure modes that could lead to uncommanded MCAS activation, such as an erroneous high 
single AOA input to the MCAS, were not simulated as part of these functional hazard assessment validation 
tests. As a result, additional flight deck effects such as IAS DISAGREE and ALT DISAGREEdid not emerge. 


The unintended MCAS-commanded stabilizer movement due to erroneous single AOA input was considered 
a failure condition with Major effect in normal flight envelope. However, this classification did not consider 
the possibility of the increased workload associated with the additional flight deck effects. 


Much has been written about the engineering design errors associated with the 737 MAX especially the 
design errors associated with the development of the MCAS software. Similar design and testing errors 
were made with the MAX's AOA Sensor part (hardware). In a June 28, 2019, revision to the System Safety 
Analysis, Boeing informed the NTSB that Erroneous data from the Captain's AOA Sensor is revised to show 
three separate conditions combined with an OR gate, meaning any one by itself could result in erroneous 
AOA data: Erroneous AOA-L Sensor, Incorrect AOA output from ADIRU-L output, OR Loss of Power to AOA-L 
Heater. 


According to the report, after the ET302 accident, Boeing informed the NTSB they had made an engineering 
design error in their initial AOA Sensor Hazard Analysis; Neither Boeing, the NTSB, nor the FAA informed 
Ethiopian authorities about this critical error that was communicated to the NTSB by Boeing seven months 
earlier. 


FAA Oversight 


According to a 2011 Office of Inspector General Audit report?, "the FAA is responsible for overseeing 


numerous aviation activities designed to ensure the safety of the flying public. Recognizing that it is not 
possible for FAA employees to personally oversee every facet of aviation, public law allows FAA to delegate 
certain functions, such as approving new Airplane designs, to private individuals or organizations (approved 
by the FAA). Designees perform a substantial amount of critical work on FAA's behalf—for example, at one 
Airplane manufacturer, they made about 90 percent of the regulatory compliance determinations for a new 
Airplane design. FAA created the Organization Designation Authorization (ODA) program in 2005 to 
standardize its oversight of organizational designees. " 

According to FAA Order 8100.15A, 49 CFR 44702(d) allows the FAA to delegate to a qualified private person 
a matter related to issuing certificates, or related to the examination, testing, and inspection necessary to 


42 Reference Office of Inspector General Audit Report, AV-2011-136, issued on June 29, 2011 
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issue a certificate on behalf of the FAA Administrator as authorized by statute to issue under 49 CFR 
44702(a). 


Boeing applied for and was granted ODA. Boeing's ODA is authorized to select and appoint individuals to 
perform some of the delegated functions as representatives of FAA. The delegated functions for a Type 
Certification (TC) ODA are: 
е establishing and determining conformity of parts, assemblies, installations, test setups, and products 
(Airplane); 


e finding compliance with airworthiness standards for new design, or major changes to design; 
• issuing special flight permits for operation of Airplane; 


е issuing issues airworthiness approvals for articles (Export), and Airplane (Standard or Export) 


Retention and delegation are accomplished with respect to compliance deliverables not to specific functions 
i.e MCAS itself would not be delegated to the ODA. 


Consistent with the FAA authorization, the FAA have discretionary authority as to what is reviewed, whether 
submitted directly to the FAA for review and approval by an applicant or submitted by a designee or ODA 
recommending approval.When delegating at the end of a program, there has been some level of FAA 
involvement and the delegation confirms that the designee should make the final approval. In all cases, 
delegation is not accomplished by a single individual but follows a structured review process. 


In the accident flight crew response assumptions in the initial design process which, coupled with the 
repetitive MCAS activations, turned out to be incorrect and inconsistent with the FHA classification of Major. 


FAA Regulation 


The Federal Aviation Administration (FAA) is responsible for prescribing minimum standards required in 
the interest of safety for the design, material, construction, quality of work, and performance of Airplane, 
Airplane engines, and propellers (Ref. 49USC44701). Product certification is a regulatory process 
administered by the FAA to ensure that an Airplane manufacturer's product conforms with Federal Aviation 
Regulations (FAR). Successful completion of the certification process enables the FAA to issue a Type 
Certificate (TC) or an Amended Type Certificate.To obtain a TC or an Amended Type Certificate, the 
manufacturer must demonstrate to the FAA that the Airplane or product being submitted for approval 
complies with all applicable regulations. The FAA determines whether or not the applicant has met its 
responsibility to show compliance to the applicable regulations. 
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The Federal regulations that apply to type certification of transport-category Airplanesare 14 CFR Part 21, 
25, 26, 33, 34, and 36. The Part 25 regulations are those concerned with the airworthiness standards for 
transport-category Airplanesand are organized into sub parts A through G. These regulations represent the 
minimum standards for airworthiness; an applicant's design may exceed these standards and the applicant's 
tests and analyses may be more extensive than required by regulation. The specific applicable regulatory 
requirements and how compliance will be demonstrated is documented in an FAA approved certification 
plan. 


3. CONCLUSIONS 


3.1Findings 


Findings are statements of all significant conditions, events or circumstances in the accident sequence. The 
findings are significant steps in the accident sequence, but they are not always causal, or indicate 
deficiencies. Some findings point out the conditions that pre-existed the accident sequence, but they are 
usually essential to the understanding of the occurrence, usually in chronological order (ICAO Doc 9756 Part 
IV paragraph 3.1). 


1. TheAirplane departed from Addis Ababa Bole International Airport bound to Nairobi, Kenya Jomo 
Kenyatta International Airport with 157 crew and passengers on board; 


2. The flight crew members were licensed and qualified for flight in accordance with the existing ECARAS 
part 2; 2.3.6. 
3. The captain was the pilot flying; 


4. The Airplane has a valid certificate of airworthiness and maintained in accordance with applicable 
regulations and procedures; 


5. The Airplane weight and balance was within the operating limits; 


6. The Airplane took-off from runway 07R at field elevation of 7,656 ft with a flap setting of 5 degrees and a 
stabilizer trim setting of 5.6 units. Both flight directors (F/D) were ON with LNAV and VNAV modes 
armed. Auto throttle (A/T) was armed; 


7. The takeoff roll and liftoff were normal, including normal values of left and right angle of attack (АОА). 
During takeoff roll, the engines stabilized at about 94% N1, from this point for most of the flight, the М1 
reference remained at about 94%; 
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8. 


9. 


10. 


11. 


12. 


13. 


14. 


15. 


16. 


17. 


Shortly after liftoff, the left and right recorded АОА values deviated. The left AOA values were erroneous 
and reached 74.5? while the right AOA reached a Maximum value of 15.3?.The difference between the left 
and the right AOA values was 59? and near the end of the recording it was 499; 


Immediately afterlift-off, the left stick shaker activated and remained active until the near end of the 
recording. It was followed by a Master Caution with the associated Anti-Ice messageon the MCP; 


IAS, ALT DISAGREE alerts were not recorded in the FDR, but the time of appearance has been computed, 
as per computation, the IAS disagree alert should normally have triggered at 5 h 38 min 49 s, and 
stopped at 5 h 43 min 28 s; and no recording of the pilot's conversation about the alerts appearing on the 
PFD. This has led to uncertainty about the appearance of alerts and the crew who thus did not apply the 
Airspeed Unreliable Non-Normal Check-list; 


As per computation, the ALT disagree alert should have triggered at 5 h 38 min 51s and stopped at 5 h 
43 min 28s and it might have triggered again at 5 h 43 min 36s during 4s; 


While the loss of valid FMC command did not trigger any alert or mode reversion, the underlying cause 
(erroneous AOA) should have triggered the IAS DISAGREE and ALT DISAGREE alerts, but from the 
manufacturer’s computations, conditions were met for the IAS DISAGREE and ALT DISAGREE alerts to 
appear on both PFD’s; 


Erroneous AOA Sensor data ultimately triggered the Maneuvering Characteristics Augmentation System 
(MCAS) which repeatedly pitched the nose of the airplane down until the pilots lost control. 
Compounding factors included the pilots lack of awareness and training associated with MCAS, confusing 
alerts, and the startle factor. 


During the event flight, A/T was engaged in the automatic takeoff sequence and due to the erroneous LH 
AOA values the FMC did not detect the thrust reduction altitude when it was sending valid engine 
commands; 


Approaching 400ft, the Captain called-out “command” and tried to engage the AP. At that time the FD 
pitch bars were out of view; 


A second attempt to engage the A/P was made six seconds later, above 500 ft. Passing 1000 ft/radio 
altitude, at the third attempt, the A/P was successfully engaged; 


Although, the use of auto flight system in most non-normal scenarios would help reduce crew workload 
and give more time for the crew to analyse the situation, it was not consistent with the procedure to use 
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19. 


20. 


21. 


22. 


23. 


24. 


25. 


26. 


27. 


28. 


it with an ongoing stick shaker. It was identified from the CVR that the flight crew did not discuss any 
issue related to the stick shaker; 


The crew was faced with unprecedented change of events shortly after lift-off which significantly 
increased crew workload; 
MCAS design on a single AOA inputs made it vulnerable to undesired activation. Its repetitive activation 
of nose down stabilizer trim made the aircraft uncontrollable; 


Post-accident analysis reveals new Airplane experienced unexplained electrical and electronic faults 
within weeks of entering service, and in the weeks and days prior to their accidents; 


During the previous maintenance actions of relevance occurred in early December 2018 and involved 
several write-ups involving temporary fluctuations of vertical speed and altitude as well as a report of 
the Airplane rolling during autopilot operation. Prior to the accident flight, Altitude and vertical speed 
indication on the PFD showed an erratic and exaggerated fluctuation indication; maintenance actions 
were performed and none were reported to have recurred; however, the erratic and intermittent nature 
of the fluctuations made it difficult to insure a permanent solution of these parameters. 

While the autopilot was engaged, systems were supplied by the erroneous LH AOA values. The A/P failed 
to fly to the target altitude resulting in accelerated speed. After reaching a maximum altitude of around 
9,100 ft (right baro corrected altitude) the Airplane started to descend; 


The A/P disconnected automatically after remaining engaged for 32 seconds; 


The activation of MCAS followed by GPWS aural alert with ongoing stick shaker, coupled with no failure 
flag or warning to indicate that the auto throttle has failed to transition to climb thrust at the critical 
phase of flight indicate that multiple happenings taking place simultaneously because of the overlapping 
effects of the erroneous AOA inputs; 


The Stall Management Yaw Damper Computer -1 (SMYDC 1) computed a LH minimum operational speed 
and a LH stick shaker speed greater than VMO (340Kt) without any alert or invalidity detection; 


As the flaps reached the up position with the autopilot OFF and because of the erroneous left AOA value, 
the FCC activated the 1st automatic nose down trim (MCAS) for 9 seconds; 


At the end of the first MCAS activation; the stabilizer position was 2.1 units with the PF pulling to pitch 
up the Airplane , with a force of around 90lbs; 


At different times when the pilot applied electrical trim for short duration or longer duration the trim 
stopped at about 2.3 for unknown reason; 
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37. 


38. 


The 2" MCAS activation, lasted 7 seconds as it was interrupted by the captain’s electric trim up inputs 
which stopped the second automatic nose-down trim activation two seconds (automatic nose-down trim 
activated for around 7 s instead of 9 s); 


The captain applied a 9 second electric trim-up input; this trim input fully counteracted the second MCAS 
input and stopped the GPWS warning but it did not bring the aircraft to a neutral trim for unknown 
reason; 


When MCAS activated for the third time, an automatic nose-down trimwas commanded by the 
FCC.There was no corresponding motion of the stabilizer, which is consistent with the stabilizer trim 
cutout switches being in the "cutout" position; 


The captain repeatedly requested the F/O to pull up with him. Both pilots applied high force on the 
control column. Pitch values oscillated between 7? nose up and -2? nose down. Pitch increased when 
both pilots applied forces, pitch decreased when a single pilot applied force (force oscillated between 80 
Ibs and 110 lbs). The vertical speed variations followed the variations of the pitch angle, with vertical 
speed was oscillating between -2,500 ft/min and 4,400 ft/min; 


The right hand speed exceeded 340Kt and overspeed warning sounded.It remained active until the end 
of the recording. The RH speed values varied between 360Kt and 375Kt (RH values). The LH computed 
airspeed oscillated between 335Kt and 350Kt; 


The captain requested the F/O to try the manual trim wheel, andafter seconds of intenseefforts 
(identified on the CVR), the F/O told the Captain that it was not working; 


The amount of force required to turn the trim wheel by the pilots was calculated and verified in the 
simulator and flight control test rig (ЕСТЕ) that it was difficult to achieve the required trim effect ; 


Simulator observation has revealed the force required to turn the manual trim during the event flight to 
be significantly high at different speed ranges from a high speed of 340Kt to a low speed of 220Kt; 


The effect of airspeed indication giving the pilot two different warnings, i.e. dangerously low airspeed 
indicated by stick shaker, minimum manoeuvring band above current airspeed versus high airspeed 
indicated by the numbers in the speed tape was a point of concern for crew; have occurred 
simultaneously which has an effect on the pilot's cross checking; 


The amount of force required to trim to neutral position both at high and low speed was found to be 
excessive during level D simulator and FCTR tests; 
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One unit of trim change requires 15 full turns and about 40 turns were required to bring the accident 
aircraft to neutral trim by using the manual trim wheel; 


The captain asked the first officer to pitch up with him, and both flight crew members kept on pulling on 
the control columns with very intense efforts with intention to climb to the MSA (14,000 ft); 


After unsuccessful attempt to use the manual trim wheel and while both crew members were pulling on 
the control column with an average force of about 110lbs, the captain told the first officer "pitch is not 
enough" Then the captain said "put them up". The FDR and CVR data synchronization was concurrent 
with the stab trim cut-out switches being returned to normal at this time; 


The Captain applied two brief electric trim up inputs of 1 second each while pulling on the control 
column with an average force of 100 Lbs; 


Five seconds after the trim-up inputs, the fourth MCAS triggered; the Airplane started to descend and 
the stabilizer decreased from 2.3 units to 1 unit of trim; 


The Captain repeatedly commanded loudly to pitch up,the forces were physically unmanageable by both 
flight crew members; due to this there were sounds of exhaustion and shortness of breath were heard in 
the CVR; 


The Airplane hit the ground eighteen seconds after the end of the 4% MCAS; 


The Airplane was destroyed during the impact and all crew members and passengers onboard were 
fatally injured; 

The FCC controlling the MCAS is dependent on a single AOA source and the MCAS contribution to 
cumulative AOA effects have not been assessed by the manufacturer during the functional hazard 
assessment; 


Functional Hazard Assessment of MCAS considered the effect of undue activation of MCAS on flight 
controls. It did not consider the possible effect of underlying root causes on other systems, displays and 
warnings. Introduction of MCAS function did not lead to revisit the SSA for failures of AOA sensors; 


There was CBT training for a few hours long which was supposed to cover the difference between MAX 
and NG but there was no information related to MCAS description in the CBT; 


MCAS and the lack of pilot training did not trigger the accident; however it was the failure of the sensors 
due to the production quality defects. If the intermittent defects did not cause the AOA Sensors to fail on 
the accident flight, MCAS would not have activated, and the accident would not have occurred. The MCAS 
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would have remained as hidden threat until its true nature is exposed by some other valid or erroneous 
causes; 


There was no information related to MCAS either in the FCOM provided by Boeing or in the AFM ; 


The error of omission is that Boeing failed to disclose early and attentively the existence of MCAS to the 
operators; 


During the whole flight, the multiple alerts (Stick shaker, clackers, warning lights, sounds) combined 
with the repetitive activation of the MCAS impacted the Crew Resource Management and increased the 
workload of the situation onboard; 


The failure of originally installed and tested Boeing AOA Sensor parts associated with fatal plane crashes 
likely involving an open circuit, wire fatigue, evidence of multiple arcing events, unexplained 
electrical/electronic anomalies, and the loss of heater power; 


Boeing has never acknowledged the electrical malfunctions that occurred on both MAX airplanes in the 
months, weeks, and days leading up to their accidents before MCAS was activated on their fatal flights; 
Stress and startle effects were not considered by the manufacturer when trying to understand how 
crew might respond to the effects of an AOA sensor fault and the erroneous activation of MCAS; 


The Captain's priority remained to control the Airplane, which is in line with flight crew training manual 
(FCTM) guideline and training at Ethiopian Airlines regarding the prioritization of tasks in case of failure 
on board; 


Repetitive MCAS activation made airplane control difficult and did not give time for the flight crew to 
proceed with further steps of task prioritization; 


During the preliminary design stage of the 737 МАХ8, Boeing tests and analysis revealed that the 
addition of the LEAP-1B engine and associated nacelle changes produced an Airplane nose-up pitching 
moment when the Airplane was operating at high angles of attack (AOA) and mid-Mach numbers; 


The B737MAX design included aerodynamicchanges as well as a stability augmentation function called 
the Maneuvering Characteristics Augmentation System (MCAS)MCAS modifies aircraft handling 
characteristics as an additional function of the existing Speed Trim System (STS) ; to improve Airplane 
handling characteristics and decrease pitch-up tendency at elevated angles of attack; 


MCAS was designed to function only during manual flight, with the Airplane’s flaps up, at an elevated 
AOA; but it was later discovered that, the MCAS function was expanded to low Mach numbers; 
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MCAS is a function within the Speed Trim System and when activated, moves the stabilizer during flaps 
up, high angle of attack maneuvers to provide a desirable increase in stick force gradient and improve 
static longitudinal stability; 


The manufacturer did not provide the operator with information and alerts related to MCAS to help 
them understand the system and know how to resolve potential issues; 


Boeing has never discussed this AOA Sensor electrical design error publicly, did not inform the EAIB 
about this error either. A loss of power can be a symptom of a EWIS failure, power quality issue and/or a 
defect inside the AOA Sensor; 


The AOA Sensor malfunction likely occurred as the result of power quality problem that resulted in the 
loss of power to the left AOA Sensor Heater. Evidence indicates that the loss of power was likely due to a 
production related intermittent electrical/electronic failure involving the airplane's Electrical Wiring 
Interconnection System (EWIS) and the AOA Sensor part; 


In March 2016, Boeing determined that MCAS should be revised to improve wings-level, flaps up, low 
Mach stall characteristics and identification. The MCAS was revised such that depending on AOA, it 
would be capable of commanding incremental stabilizer to a Maximum of 2.5 degrees at low Mach 
decreasing to a maximum of 0.65 degrees at high Mach; 


Uncommanded MCAS function was considered “Major“instead of being categorized as “Catastrophic” 
during the fault hazard assessment (FHA) by Boeing. Boeing reasoned that such a failure could be 
countered by using the elevator alone. In addition, stabilizer trim is available to offload column forces, 
and stabilizer cutout is also available but not required to counter failure. But the associated failures and 
flight deck effects were not considered in reaching this assessment; 


During validation, Boeing considered MCAS activation could occur as a result of erroneous AOA but did 
not test repetitive erroneous MCAS activations in a flight simulation; 


When Uncommanded MCAS function was considered “Major,” Boeing did not perform a specific fault 
tree analysis for an uncommanded MCAS hazard and failed to classify MCAS as a safety-critical system, 
which would have attracted greater FAA analysis during the certification process; 


The control column force to maintain level flight could eventually increase to a level where control 
forces alone may not be adequate to control the Airplane. The cumulative mistrim could not be 
countered by using the elevator alone which was contrary to the Boeing assumption during FHA. The 
events that led to the accident flight showed that in the event of repetitive MCAS activation without 
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sufficient trim commands to return to trimmed flight, the cumulative mistrim could not be countered by 
using elevator alone; 


When MCAS authority was increased to 2.5 degrees at low speed, Boeing's requirements document 
indicated that the preliminary functional hazard assessments of MCAS were re-evaluated by pilot 
assessments in motion simulator and by engineering analysis and determined to have not changed in 
hazard classification of "Major"; 


Boeing's consideration regarding crew action to meet MCAS did not consider the cumulative effect of 
different flight deck alerts and warning as in the accident flights; 


On ET 302 accident, the system failure led to a complicated series of events and flight crew response did 
not match the assumptions used in the initial design process upon which the FHA classification of Major 
was based; 


The specific failure modes that could lead to uncommanded MCAS activation, such as an erroneous high 
single AOA input to the MCAS, were not simulated as part of the functional hazard assessment validation 
tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and 
stick shaker activation) resulting from the same underlying failure (for example, erroneous AOA) were 
not simulated and were not documented in the stabilizer trim and autoflight safety assessment; 


A single AOA failure resulted in many failures and warnings to happen at the same time and MCAS which 
was dependent on single AOA kept pushing the airplane's nose down based on faulty data, which led to 
catastrophic consequences; 


To obtain a type certification (TC) or an Amended Type Certificate, the manufacturer demonstrate to the 
FAA that the Airplane or product being submitted for approval complies with all applicable regulations, 
but there was no evidence that Boeing has complied with; 


MCAS was added on the 737 MAX to address potentially unacceptable nose-up pitching moment at high 
angles of attack at high airspeeds; there was no mention that MCAS had been revised to improve flaps 
up, low Mach tall characteristics and identification. 


MCAS would never have activated repeated nose down trim if the flaps were still left down, even in the 
presence of erroneous AOA. This critical information was not included in the FCOM bulletin or in the 
airworthiness directive; 
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The absence of MCAS description in the FCOM, in the flight crew training manual, and the absence of an 
AOA indicator made it difficultfor the flight crew to identify the problem on the accident Airplane and 
find the corrective measure to solve; 


Boeing and FAA released FCOM bulletin ETH-12 on November 6, 2018 and FAA AD# 2018-23-51 on 
November 7, 2018 respectively. Both documents were incorporated in the Ethiopian airlines FCOM and 
AFM per the instruction therein; 


The ECAA issued AD #2018-23-51 dated 08 Nov, 2018 to advise the operator to revise and implement its 
AFM and operating procedures and report to the authority within the specified time. The operator 
confirmed to the ECAA that it has complied with the instruction; 


The FAA's AD and Boeing Bulletin released after Lion Air accident focused only on RUNAWAY 
STABILIZER; 


The emergency AD pilot procedures were inadequate and unverified. AD 2018-23-51 does not mention 
the possibility of an auto throttle malfunction due to an erroneous AOA input; 


The data from the flight data recorders, as summarized in reports of the Ethiopian Airlines Flight 302 
accident and the Lion Air Flight 610 accident, indicated that if a single erroneously high AOA sensor 
input is received by the flight control system, the maneuvering characteristics augmentation system 
(MCAS) can command repeated Airplane nose-down trim of the horizontal stabilizer. This unsafe 
activation of the MCAS made the Airplane uncontrollable that led to excessive Airplane nose-down 
attitude, significant altitude loss, and impact with terrain; 


After, the ET 302 accident the Ethiopian Civil Aviation Authority as per ECARAS part 8, section 8.2.1.2 (a) 
notified that the Ethiopian Airlines Group that all Boeing 7373MAX-8 fleet of Airplane grounded and was 
not allowed making commercial flights effective March 11, 2019; 


The difference training from B737NG to B737MAX provided by the manufacturer was found to be 
inadequate; 


Post Lion Air accident and prior to ET-302 accident, Ethiopian Airlines training department 
communicated to Boeing requesting clarification on the MCAS design and the operational procedures of 
the FCOM bulletin regarding checklist prioritization and whether run-away stabilizer checklist was 
enough to handle the situation and the need to include airspeed unreliable checklist.In its reply, Boeing 
did not answer all asked questions made by Ethiopian airlines training department, indicating that it was 
related to an ongoing Lion Air accident investigation; 
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88. The investigation found the questions raised by the airline to be safety critical and if Boeing had 
answered the questions raised by the training department either directly or indirectly through a revision 


of the FCOM bulletin or a suggested training, it would have significantly altered the outcome. 


3.2Probable cause of the accident 


Repetitive and uncommanded airplane-nose-down inputs from the MCAS due to erroneous AOA input, 


and its unrecoverable activation system which made the airplane dive with the rate of -33,000 ft/min 
close to the ground was the most probable cause of the accident. 


3.3 Contributing Factors 


1. 


The MCAS design relied on a single AOA sensor, making it vulnerable to erroneous input from the 
sensor; 


. During the design process, Boeing failed to consider the potential for uncommanded activation of 


MCAS, but assumed that pilots would recognize and address it through normaluse of the control 
column, manual electric trim, and the existing Runaway Stabilizer NNC. The OMB and Emergency AD 
issued after the Lion Air accident included additional guidance but did not have the intended effect of 
preventing another MCAS-related accident; 


. While Boeing considered the possibility of uncommanded MCAS activation as part of its FHA, it did not 


evaluate all the potential alerts and indications that could accompany a failure leading to an 
uncommanded MCAS; 


. The MCAS contribution to cumulative AOA effects was not assessed; 
. The combined effect of alerts and indications that impacted pilot's recognition and procedure 


prioritization were not evaluated by the Manufacturer; 


. Absence of AOA DISAGREE warning flag on the flight display panels (PFD); 
. The B737 MAX Crew difference CBT training prepared by Boeing and delivered to Pilots did not cover 


the MCAS system; 


Failure by the manufacturer to design simulator training for pilots with regards to safety critical 
systems like MCAS with catastrophic consquences during undesired activation. 


The manufacturer failed to provide procedures regarding MCAS operation to the crew during 
training or in the FCOM; 
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10. Failure by the manufacturer to address the safety critical questions raised by the airline which would 
have cleared out crew confusion and task prioritization; 


4.SAFETY RECOMMENDATIONS 
4.1 New Safety Recommendation 


The EAIB identified safety issue that need to be considered, it is therefore recommended to address safety 
issues identified in this report and consider the safety actions were relevant to improve safety, and 
encourage the implementation of these safety actions. The EAIB also considered the action taken and put the 
responses under the recommended actions. 


1. Multiple alerts, stick shaker, repetitive MCAS activations impacted the flight crew understanding of the 
situation on board and didn't enable them to handle the flight efficiently;This obscured the problem 
andthe flight crew could not arrive at a solution during the initial or subsequent automatic AND 
stabilizer trim input. 


Therefore, the EAIB recommends that the Airplane manufacturer consider the effect of all possible flight 
deck alerts and indications on flight crew recognition and response; and incorporate design, flight crew 
procedures, and/or training requirements where needed to minimize the potential for flight crew actions 
that are inconsistent with manufacturer assumptions. 


2. There was CBT training for a few hours long which were supposed to cover the difference between MAX 
and NG but there was no information related to MCAS description in the system. Instead, It was advised 
that the Airplane has wide and moved a bit forward body, Size of the Engine which is 84" and the height 
of the nose gear about 5.6" high. 


The EAIB recommend that the manufacturer providesufficient time and adequate training associated witha 
new MCAS description in the system. 


3. The specific failure modes that could lead to uncommanded MCAS activation, such as an erroneoushigh 
angle from a single AOA input to the MCAS, were not simulated as part of the functional hazard 
assessment validation tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT 
DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, 
erroneous AOA) were not simulated and documented in the stabilizer trim and autoflight safety 
assessment; 


The EAIB recommends that the Boeing to reconsider the design of the system in such a way that AOA data 
input from both sensors (LH&RH)are received and analyzed by FCC before sending any command to MCAS. 
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4. Without descriptive MCAS awareness of the function and its effect, it would be more difficult for the 
flight crew to understand the complexity. Instead of focusing on the runaway stabilizer in the AD, the 
crewwould have been aware of MCAS which would have provided them with better understanding of the 
system and raise their chances of mitigating consequences of repetitive MCAS activations in the accident 
flight. 


The EAIB recommendsthat Boeing instead of runaway stabilizer provide MCAS description and advise how 
to mitigate MCAS duringrepetitive AND command; 


5. FHA of MCAS was considered the effect of undue activation of MCAS on flight controls, but it did not 
consider possible effect of underlying root causes on other systems, displays and warnings. Introduction 
of MCAS function did not lead to revise the SSA for failures of AOA sensors. 


The EAIB recommends that the FAA to review all probable causes of failure which have been considered 
during functional hazard assessment. 


6. The data from the flight data recorders, as summarized in reports of the ET 302 accident and the Lion Air 
Flight 610 accident, indicated that if a single erroneously high AOA sensor input is received by the flight 
control system, MCAS can command repeated Airplane nose-down trim of the horizontal stabilizer. This 
unsafe condition, if not addressed, could cause the flight crew to have difficulty controlling the Airplane, 
and lead to excessive Airplane nose-down attitude, significant altitude loss, and impact with terrain; 


The EAIB recommends that the manufacturer put awareness for the effect of a single erroneously high AOA 
sensor input is received by the flight control system, the MCAS can command repeated Airplane nose-down 
trim of the horizontal stabilizer which leads to excessive Airplane nose-down attitude, significant altitude 
loss, and impact with terrain; 


7. Ethiopian Civil Aviation Authority 

The HAAB Airport emergency plan was applied as soon as the accident occurred but the required rescue 
team did not deploy soon after the accident, however the Abyssinian flight service and Ethiopian Air force 
helicopter seized action for rescuing the site. 


The EAIB recommends that: The Civil Aviation Authority should dispatch a Search and Rescue team 
without delay and ensure appropriate action is taken at the accident site. 


8. The Operator/ Ethiopian Airlines Group 


The critical statement that was omitted from the AD was the flap position. MCAS operates only when the flap 
is fully up. Following the issuance of this AD, the ETH asked clarification from Boeing via email whether they 
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should do airspeed unreliable procedures first. The response they got was that Boeing could not make 
further comments as the case was under investigation. 


The EAIB recommends that: The ETH to initiate and develop procedure for continuous monitoring, follow 
up, and obtain clarification for asked questions in timely manner. 


4.2. EAIB Interim Report Safety Recommendations 


1.The design of MCAS should consider the use of data from both AOA and/or other independent systems 
for redundancy. 


2.The regulator shall confirm all probable causes of failure have been considered during functional 
hazard assessment. 


3.The manufacturer shall insure the minimum operational speed computed by the SMYD to be within 
logical value. There should also be logic to validate the computation. 


4. The difference training should also include simulator sessions to familiarize with normal and non- 
normal MCAS operation. The Training simulators need to be capable of simulating AOA failure 
scenarios; 

5. The manufacture should confirm the AOA DISAGREE alert is functional whether the optional angle of 
attack indicator is installed or not. 


4.3. Boeing Responses to "EAIB Interim Report" Recommendations 


1. The design of MCAS should consider the use of data from both AOA and/or other independent systems for 
redundancy. 


Response to Recommendation 1: 


In November 2020, Boeing published Service Bulletin 737-22A1342 which provides Flight Control 
Computer (FCC) Operational Program Software (OPS) version P12.1.2 for 737-8 and 737-9 airplane FCC OPS 
P12.1.2 incorporates several enhancements to the Speed Trim System, specifically to the Maneuvering 
Characteristics Augmentation System (MCAS) function. MCAS can only be activated while flaps up, autopilot 
disengaged and operating at elevated AOA. MCAS inputs incremental nose down stabilizer trim as a function 
of Mach and AOA to provide an increased column force gradient at elevated AOA. 


The enhancements include AOA signal monitoring (from both AOA sensors), activation and stabilizer 
resynchronization logic, Maximum command limit and flight deck alerting. These enhancements provide 
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additional functionality to prevent erroneous MCAS activation and ensure sufficient maneuver capability is 
provided in the event of multiple MCAS activations. 


In November 2020, the FAA published Airworthiness Directive 2020-24-02 which requires operators to 
install FCC OPS P12.1.2 in accordance with Boeing SB 737- 2241342. 


2. The regulator shall confirm all probable causes of failure have been considered during functional hazard 
assessment. 

3. The manufacturer shall insure the minimum operational speed computed by the SMYD to be within logical 
value. There should also be logic to validate the computation. 


Boeing's response dated 13 January 2021 


In November 2020, the FAA published Airworthiness Directive 2020-24-02 which set forth the 
requirements for the 737-8 to return to service. These requirements included software updates to both the 
Flight Control Computer (FCC) and the MAX Display System (MDS). Boeing is undertaking further safety 
enhancements to the 737-8 to reduce the workload which can arise as a result of erroneous angle-of-attack 
(АОА). 


This work will involve additional AOA validity checks within the Air Data Inertial Reference Unit and the 
Stall Management Yaw Damper (SMYD). As part of this enhancement, the SMYD software will be updated to 
include specific checks on the minimum operational speed computed by the SMYD and used by the auto 
flight system. This work will be completed in conjunction with certification of the 737-10. 


4. The difference training should also include simulator sessions to familiarize with normal and non-normal 
MCAS operation. The Training simulators need to be capable of simulating AOA failure scenarios. 


Boeing's response dated 13 January 2021: 


On 16 November 2020, The FAA published revision 17 to the B-737 Flight Standardization Board Report. 
This document, which was result of the FAA Airplane Evaluation Groups working with Boeing, provides 
flight crew member training, checking, and currency requirements. 


The revision includes a new Appendix 7 which describes ground and flight training requirements associated 
with pilot qualification on the 737 MAX, including Level C or D Full Flight Simulator training. As noted in the 
appendix: 


No pilot may operate the 737 MAX unless the ground and flight training documented in this appendix has 
been completed. References to "pilots" in this section include both PICs and SICs unless otherwise specified. 
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MCAS operation familiarization is required by paragraph 2.1: 

2.1 Demonstration of MCAS activation accomplished by a pilot acting as PF. 
Enclosure to 66-ZB-H200-ASI-19199 

Response to Safety Recommendations #1 and #4 from Interim Report 
Ethiopian Airlines 737-8 ET-AV] Accident, Ejere, Ethiopia, 10 March 2019 


2.1.1 MCAS activation during an impending stall (or full stall) and recovery demonstration during manual 
flight in a clean configuration. 


2.1.2 Demonstrate MCAS activation stabilizer trim responses: Stabilizer trim in the nose down direction 
when above threshold AOA for MCAS activation during stall. Stabilizers trim in the nose up direction when 
below threshold AOA for MCAS activation during recovery 


Paragraph 2.5 of Appendix 7 requires familiarization with erroneous high AOA during takeoff. This is the 
scenario which occurred during the ET302 accident, however, with the installation of FCC OPS P12.1.2, 
erroneous high AOA no longer leads to non-normal MCAS operation. 


2.2. Erroneous high AOA during takeoff that leads to an unreliable airspeed condition accomplished by 
either pilot acting as PF. 


2.2.1. Demonstrates flight deck effects (i.e., aural, visual, and tactile) associated with the failure. 

2.2.2. Fault occurring during the takeoff procedure. 

2.2.3 Must include a go-around or missed approach flown with erroneous highAOA condition 

Special emphasis placed on FD behavior biasing out of view upon selecting takeoff/go-around (TO/GA). 


5. The manufacture should confirm the AOA DISAGREE alert is functional whether the optional angle of 
attack indicator is installed or not. 

In June 2020, Boeing published Service Bulletin 737-31-1860 which provides MAX Display System (MDS) 

Blockpoint (BP) 1.5.1 software for 737-8 and 737-9 airplane. In prior MDSBP versions, the Angle of Attack 

Disagree (AOA DISAGREE) alert message on the Primary Flight Display (PFD) was dependent on the 

activation of the AOA Round Dial display option. MDS BP 1.5.1 includes a revision to the display of the AOA 

DISAGREE alert message on the PFD to be independent of the AOA Round Dial option. 
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In November 2020, the FAA published Airworthiness Directive 2020-24-02 which requires 
operators to install MDS BP 1.5.1 in accordance with Boeing SB 737-31-1860. 


4.4. Safety Actions Taken After the Lion Air Accident in Indonesia 


On 6 November 2018, Boeing issued a Flight Crew Operation Manual Bulletin (OMB) Number TBC-19 with 
subjected Un-commanded Nose down Stabilizer Trim Due to Erroneous Angle of Attack (АОА) During 
Manual Flight Only to emphasize the procedures provided in the runaway stabilizer non-normal checklist 
(NNC). The detail of the FCOM Bulletin (see appendix A) 


Information in this bulletin is recommended by The Boeing Company, but may not be FAA approved at the 
time of writing. In the event of conflict with the FAA approved Airplane Flight Manual (AFM), the AFM shall 
supersede. The Boeing Company regards the information or procedures described herein as having a direct 
or indirect bearing on the safe operation of this model Airplane. 


November 7, 2018 Emergency Airworthiness Directive (AD) 2018-23-51 was sent to owners and operators 
of the Boeing Company Model 737-8 and -9 Airplane s. (See Appendix B) 


This emergency AD was prompted by analysis performed by the manufacturer showing that if an 
erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is а 
potential for repeated nose-down trim commands of the horizontal stabilizer. This condition, if not 
addressed, could cause the flight crew to have difficulty controlling the Airplane, and lead to excessive nose- 
down attitude, significant altitude loss, and possible impact with terrain. 


This AD was issued in accordance with authority delegated by the Executive Director, Airplane Certification 
Service, as authorized by FAA Order 8000.51C. In accordance with that order, issuance of ADs is normally a 
function of the Compliance and Airworthiness Division, but during this transition period, the Executive 
Director has delegated the authority to issue ADs applicable to transport category Airplanesand associated 
appliances to the Director of the System Oversight Division. 


е Nov 08, 2018 The ECAA issued AD 2018-23-51 which was released by FAA on November 07, 2018 
applicable for 737 MAX-8, 9 Airplane s. The operator was advised to revise its AFM and operating 
procedures. The ECAA advised the operator implementing the AD and report to the authority within the 
specific time provided and this was confirmed by the operator response that has been done accordingly, 
the details is available on (see appendix C) 

e Оп 11 November 2018, Boeing informed ай 737NG/MAX Costumers, Regional Directors, Regional 
Managers and Boeing Field Service Bases via a Multi Operator Messages (MOM) detailing the MCAS 


Charasteristics.The details of the MOM (see appendix D) 
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4.5. Safety Actions Taken After the ET 302 Accident 


March 11, 2019 after, the ET 302 accident the Ethiopian Civil Aviation Authority as per ECARAS part 8, 
section 8.2.1.2 (a) notified that the Ethiopian Airlines Group that all Boeing 7373MAX-8 fleet of Airplane 
grounded and was not allowed making commercial flights effective March 11, 2019. The detail of is available 
(see appendix E) 


е March 12, 2019 European Union Aviation Safety Agency declared Boeing 737-8 MAX and 737-9 MAX 
suspension of flight Operations. 
Required Action(s) and Compliance Time(s): 


From the effective date and time of this SD, do not perform commercial air transport operations with Boeing 
737-8 'MAX' or Boeing 737-9 'MAX' into, within or out of the territory subject to the provisions of the Treaty 
on European Union. The detail of MAX suspension of flight Operations (see Appendix F) 


e March 13, 2019 with the potential relationship established between the two accidents, the FAA issued 
an Emergency Order of Prohibition (see Appendix G grounding 737 MAXAirplane. 

In November 2020, Boeing published Service Bulletin 737-22A1342 which provides Flight Control Computer 
(FCC) Operational Program Software (OPS) version P12.1.2 for 737-8 and 737-9 Airplane. FCC OPS P12.12 
incorporates several enhancements to the Speed. Trim System, specifically to the Maneuvering 
Characteristics Augmentation System (MCAS) function. MCAS can only be activated while flaps up, autopilot 
disengaged and operating at elevated AOA. MCAS inputs incremental nose down stabilizer trim as a function 
of Mach and AOA to provide an increased column force gradient at elevated AOA. 


The enhancements include AOA signal monitoring (from both AOA sensors), activation and stabilizer 
resynchronization logic, Maximum command limit and flight deck alerting. 


These enhancements provide additional functionality to prevent erroneous MCAS activation and ensure 
sufficient maneuver capability is provided in the event of multiple MCAS activations. 


On November 2020, the FAA published Airworthiness Directive 2020-24-02 which requires operators to 
install FCC OPS P12.1.2 in accordance with Boeing SB 737-22A1342. 


On 16 November 2020, The FAA published revision 17 to the B-737 Flight Standardization Board Report. 
This document, which was result of the FAA Airplane Evaluation Groups working with Boeing, provides 
flight crew member training, checking, and currency requirements. 
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The revision includes a new Appendix 7 which describes ground and flight training requirements associated 
with pilot qualification on the 737 MAX, including Level C or D Full Flight Simulator training. As noted in the 
appendix; 


No pilot may operate the 737 MAX unless the ground and flight training documented in this appendix has 
been completed. References to "pilots" in this section include both PICs and SICs unless otherwisespecified. 


MCAS operation familiarization is required by paragraph 2.1: 
2.1 Demonstration of MCAS activation accomplished by each pilot acting as PF. 


2.1.1 MCAS activation during an impending stall (or full stall) and recovery demonstration during manual 
flight in a clean configuration. 


2.1.2 Demonstrate MCAS activation stabilizer trim responses: 
- Stabilizer trim in the nose down direction when above threshold AOA for MCAS activation during stall. 
- Stabilizer trim in the nose up direction when below threshold AOA for MCAS activation during recovery 


Paragraph 2.5 of Appendix 7 requires familiarization with erroneous high AOA during takeoff. This is the 
scenario which occurred during the ET302 accident, however, with the installation of FCC OPS P12.1.2, 
erroneous high AOA no longer leads to non-normal MCAS operation. 


2.5 Erroneous high AOA during takeoff that leads to an unreliable airspeed condition accomplished by either 
pilot acting as PF. 


2.5.1 Demonstrates flight deck effects (i.e., aural, visual, and tactile) associated with the failure. 

2.5.2 Fault occurring during the takeoff procedure. 

2.5.3 Must include a go-around or missed approach flown with erroneous high AOA condition 

2.5.3.1Special emphasis placed on FD behavior biasing out of view upon selecting takeoff/go-around 
(TO/GA). 


4.6. NTSB Recommendations to FAA 


On 19th September 2019, the U.S NTSB Board issued seven Safety Recommendations during the course of 
the investigations led by Indonesia and Ethiopia on the B 737 MAX accidents. These recommendations 
mainly focused on the US design certification process used to approve the original design of the 
Maneuvering Characteristics Augmentation System (MCAS) on the Boeing 737 MAX. 
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Require that Boeing (1) ensure that system safety assessments for the 737 MAX in which it assumed 
immediate and appropriate pilot corrective actions in response to uncommanded flight control inputs , from 
systems such as the Maneuvering Characteristics Augmentation System, consider the effect of all possible 
flight deck alerts and indications on pilot recognition and response; and (2) incorporate design 
enhancements (including flight deck alerts and indications), pilot procedures, and/or training 
requirements, where needed, to minimize the potential for and safety impact of pilot actions that are 
inconsistent with manufacturer assumptions. (A-19-10) 


Require that for all other US type -certificated transport-category Airplane s, manufacturers (1) ensure that 
system safety assessments for which they assumed immediate and appropriate pilot corrective actions in 
response to uncommanded flight control inputs consider the effect of all possible flight deck alerts and 
indications on pilot recognition and response; and (2) incorporate design enhancements (including flight 
deck alerts and indications), pilot procedures, and/or training requirements, where needed, to minimize the 
potential for and safety impact of pilot actions that are inconsistent with manufacturer assumptions(A-19- 
11) 


Notify other international regulators that certify transport-category Airplane type designs (for example, the 
European Union Aviation Safety Agency, Transport Canada, the National Civil Aviation Agency-Brazil, the 
Civil Aviation Administration of China, and the Russian Federal Air Transport Agency) of Recommendation 
A-19-11 and encourage them to evaluate its relevance to their processes and address any changes, if 
applicable(A-19-12) 


Develop robust tools and methods, with the input of industry and human factors experts, for use in 
validating assumptions about pilot recognition and response to safety -significant failure conditions as part 
of the design certification process (A-19-13) 


Once the tools and methods have been developed as recommended in Recommendation A-19-13, revise 
existing Federal Aviation Administration (FAA) regulations and guidance to incorporate their use and 
documentation as part of the design certification process, including re-examining the validity of pilot 
recognition and response assumptions permitted in existing FAA guidance. (A-19-14) 


Develop design standards, with the input of industry and human factors experts, for Airplane system 
diagnostic tools that improve the prioritization and clarity of failure indications (direct and indirect) 
presented to pilots to improve the timeliness and effectiveness of their response. (A-19-15) 
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Once the design standards have been developed as recommended in Recommendation A-19-15, require 
implementation of system diagnostic tools on transport-category Airplane to improve the timeliness and 
effectiveness of pilots' response when multiple flight deck alerts and indications are present.(A-19-16) 


4.7. Design Certification Safety Recommendations Summary 


On March 10, 2019, Ethiopian Airlines flight 302, a Boeing 737 MAX 8, Ethiopian registration ЕТ-АУ), 
crashed near Ejere, Ethiopia, shortly after takeoff from Addis Ababa Bole International Airport, Ethiopia. The 
flight was a scheduled international passenger flight from Addis Ababa to Jomo Kenyatta International 
Airport, Nairobi, Kenya. All 157 passengers and crew on board died, and the Airplane was destroyed. The 
investigation is being led by the Ethiopia Accident Investigation Bureau. 


The Airplane 's DFDR data indicated that shortly after liftoff, the left (captain's) AOA sensor data increased 
rapidly to 74.5? and was 59.2? higher than the right AOA sensor; the captain's stick shaker activated. 
Concurrently, the airspeed and altitude values on the left side disagreed with, and were lower than, the 
corresponding values on the right side; in addition, DFDR data indicated a Master Caution alert. Similar to 
the Lion Air accident flight, a 9-second automatic AND stabilizer trim input occurred after flaps were 
retracted and while in manual flight (no autopilot). About 3 seconds after the AND stabilizer motion ended, 
using the stabilizer trim switches, the captain, who was the pilot flying, partially countered the AND 
stabilizer input by applying ANU electric trim. About 5 seconds after the completion of pilot trim input, 
another automatic AND stabilizer trim input occurred. The captain applied ANU electric trim and fully 
countered the second automatic AND stabilizer input; however, the Airplane was not returned to a fully 
trimmed condition. Cockpit voice recorder data indicated that the flight crew then discussed the STAB TRIM 
CUTOUT switches, and shortly thereafter DFDR data were consistent with the STAB TRIM CUTOUT switches 
being moved to CUTOUT. However, because the Airplane remained in an out-of-trim condition, the crew was 
required to continue applying force to the control column to maintain level flight. About 32 seconds before 
impact, two momentary pilot-commanded electric ANU trim inputs and corresponding stabilizer movement 
were recorded, consistent with the STAB TRIM CUTOUT switches no longer being in CUTOUT. Five seconds 
after these short electric trim inputs, another automatic AND stabilizer trim input occurred, and the Airplane 
began pitching nose down. 


43Information in this section is taken from the preliminary report on this accident, 
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Safety Issue Summary 


On the previous Lion Air flight and the Lion Air and Ethiopian Airlines accident flights, the DFDR recorded 
higher AOA sensor data on the left side than on the right (about 20? higher in the previous Lion Air flight and 
the Lion Air accident flight and about 59? higher on the Ethiopian Airlines accident flight). As previously 
stated, the MCAS becomes active when the Airplane 's AOA exceeds a certain threshold. Thus, these 
erroneous AOA data inputs resulted in the MCAS activating on the accident flights and providing the 
automatic AND stabilizer trim inputs. The erroneous high AOA sensor input that caused the MCAS activation 
also caused several other alerts and indications for the flight crews. The stick shaker was activated on both 
accident flights and the previous Lion Air flight. In addition, IAS DISAGREE and ALT DISAGREE alerts 
occurred on all three flights. Also, the Ethiopian Airlines flight crew received a Master Caution alert. Further, 
after the flaps were fully retracted, the unintended AND stabilizer inputs required the pilots to apply 
additional force to the columns to maintain the Airplane's climb attitude. 


Multiple alerts and indications can increase pilots’ workload, and the combination of the alerts and 
indications did not trigger the accident pilots to immediately perform the runaway stabilizer procedure 
during the initial automatic AND stabilizer trim input.In all three flights, the pilot responses differed and did 
not match the assumptions of pilot responses to unintended MCAS operation on which Boeing based its 
hazard classifications within the safety assessment and that the FAA approved and used to ensure the design 
safely accommodates failures. 


Certification Process Safety Issues 


Incomplete consideration by Airplane manufacturers of the effect of multiple alerts and indications when 
making assumptions about and assessing pilot response to flight control system failure conditions. 


Need for more robust, standardized methodology and/or tools for manufacturers' use in assessing and 
validating assumptions about pilot recognition and response to safety-significant failure condition(s). 


Need for enhanced Airplane system diagnostic tools to improve pilot understanding of which actions take 
priority when responding to multiple failure indications and alerts. 
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APPENDIX A: FLIGHT CREW OPERATION MANUAL 


(eme 


Flight Crew Operations Manual Bulletin 
for 
Тһе Boeing Company 


The Boeing Company лэ” 
Seattle, Washington 98124-2207 2257 


Number: TBC-19 
IssueDate: November 6, 2018 


Airplane Effectivity: 737-8 / -9 


Subject: Uncommanded Nose Down Stabilizer Trim Due to Erroneous Angle of 
Attack (AOA) During Manual Flight Only 


Reason: To Emphasize the Procedures Provided in the Runaway Stabilizer Non- 
Normal Checklist (NNC). 


Information in this bulletin is recommended by The Boeing Company, but may not be FAA approved 
at the time of writing. In the event of conflict with the FAA approved Airplane Flight Manual 
(AFM), the AFM shall supersede. The Boeing Company regards the information or procedures 
described herein as having a direct or indirect bearing on the safe operation of this model airplane. 


THE FOLLOWING PROCEDURE AND/OR INFORMATION IS EFFECTIVE UPON RECEIPT 


Background Information 


The Indonesian National Transportation Safety Committee has indicated that 
Lion Air flight 610 experienced erroneous AOA data. Boeing would like to call 
attention to an AOA failure condition that can occur during manual flight only. 
This bulletin directs flight crews to existing procedures to address this condition. 


In the event of erroneous AOA data, the pitch trim system can trim the stabilizer 
nose down in increments lasting up to 10 seconds. The nose down stabilizer trim 
movement can be stopped and reversed with the use of the electric stabilizer trim 
switches but may restart 5 seconds after the electric stabilizer trim switches are 
released. Repetitive cycles of uncommanded nose down stabilizer continue to 
occur unless the stabilizer trim system is deactivated through use of both STAB 
TRIM CUTOUT switches in accordance with the existing procedures in the 
Runaway Stabilizer NNC. It is possible for the stabilizer to reach the nose down 
limit unless the system inputs are counteracted completely by pilot trim inputs 
and both STAB TRIM CUTOUT switches are moved to CUTOUT. 


Boeing Proprietary. Copyright С) Boeing. May be subject to export restrictions under EAR. See title page for details. 


November 6, 2018 D6-27370-MAX-TBCNFF B-19 Page 1 of 2 
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Flight Crew Operations Manual Bulletin No. TBC-19 , Dated November 6, 2018 (continued) 


Additionally, pilots are reminded that an erroneous AOA can cause some or all of 
the following indications and effects: 
* Continuous or intermittent stick shaker on the affected side only. 
* Minimum speed bar (red and black) on the affected side only. 
* Increasing nose down control forces. 
* Inability to engage autopilot. 
* Automatic disengagement of autopilot. 
“ IAS DISAGREE alert. 
“ ALT DISAGREE alert. 
* AOA DISAGREE alert (if the AOA indicator option is installed) 
* FEEL DIFF PRESS light. 


Operating Instructions 


In the event an uncommanded nose down stabilizer trim is experienced on the 
737-8 /-9, in conjunction with one or more of the above indications or effects, do 
the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches 
are set to CUTOUT and stay in the CUTOUT position for the remainder of the 
flight. 


Note: Initially, higher control forces may be needed to overcome any 
stabilizer nose down trim already applied. Electric stabilizer trim can 
be used to neutralize control column pitch forces before moving the 
STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim 
can be used after the STAB TRIM CUTOUT switches are moved to 
CUTOUT. 


Administrative Information 


Insert this bulletin behind the Bulletin Record page in Volume 1 of your Flight 
Crew Operations Manual (FCOM). Amend the FCOM Bulletin Record page to 
show bulletin TBC-19 "In Effect" (IE). 


This Bulletin remains in effect until Boeing provides additional information on 
system updates that may allow this Bulletin to be canceled. 


Please send all correspondence regarding Flight Crew Operations Manual 
Bulletin status, to the 737 Manager, Flight Technical Data, through the Service 
Requests Application (SR App) on the MyBoeingFleet home page. 


Boeing Proprietary. Copyright © Boeing May be subject to export restrictions under EAR. See title page for details. 
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APPENDIX B: FAA EMERGENCY AIRWORTHINESS DIRECTIVE 


EMERGENCY 
AIRWORTHINESS 
Aviation Safety DIRECTIVE 


www.faa.gov/aircraft/safety/alerts/ 


DATE: November 7, 2018 
AD #: 2018-23-51 


Emergency Airworthiness Directive (AD) 2018-23-51 is sent to owners and operators of The 
Boeing Company Model 737-8 and -9 airplanes. 


Background 


This emergency AD was prompted by analysis performed by the manufacturer showing that if 
an erroneously high single angle of attack (AOA) sensor input is received by the flight control 
system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer. This 
condition, if not addressed, could cause the flight crew to have difficulty controlling the airplane, and 
lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain. 


FAA's Determination 


We are issuing this AD because we evaluated all the relevant information and determined the 
unsafe condition described previously is likely to exist or develop in other products of the same type 
design. Due to the need to correct an urgent safety of flight situation, good cause exists to make this 
AD effective in less than 30 days. 


AD Requirements 


This AD requires revising certificate limitations and operating procedures of the airplane 
flight manual (АҒМ) to provide the flight crew with runaway horizontal stabilizer trim procedures to 
follow under certain conditions. 


Interim Action 


We consider this AD interim action. If final action is later identified, we might consider 
further rulemaking then. 


Authority for this Rulemaking 


Title 49 of the United States Code specifies the FA A's authority to issue rules on aviation 
safety. Subtitle I, Section 106, describes the authority of the FAA Administrator. Subtitle VII, 
Aviation Programs, describes in more detail the scope of the Agency's authority. 


We are issuing this rulemaking under the authority described in Subtitle VII, Part А. 
Subpart ІП, Section 44701, “General requirements." Under that section, Congress charges the FAA 
with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices. 
methods, and procedures the Administrator finds necessary for safety in air commerce. This 
regulation is within the scope of that authority because it addresses an unsafe condition that is likely 
to exist or develop on products identified in this rulemaking action. 
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This AD is issued in accordance with authority delegated by the Executive Director, Aircraft 
Certification Service, as authorized by FAA Order 8000.51C. In accordance with that order, issuance 
of ADs is normally a function of the Compliance and Airworthiness Division, but during this 
transition period, the Executive Director has delegated the authority to issue ADs applicable to 
transport category airplanes and associated appliances to the Director of the System Oversight 
Division. 


Presentation of the Actual AD 


We are issuing this AD under 49 U.S.C. Section 44701 according to the authority delegated to 
me by the Administrator. 


2018-23-51 The Boeing Company: Product Identifier 2018-NM-151-AD. 
(a) Effective Date 
This Emergency AD is effective upon receipt. 
(b) Affected ADs 
None. 
(c) Applicability 


'This AD applies to all The Boeing Company Model 737-8 and -9 airplanes, certificated in any 
category. 


(d) Subject 
Air Transport Association (ATA) of America Code 27, Flight controls. 
(e) Unsafe Condition 


This AD was prompted by analysis performed by the manufacturer showing that if an 
erroneously high single angle of attack (AOA) sensor input is received by the flight control system, 
there is a potential for repeated nose-down trim commands of the horizontal stabilizer. We are issuing 
this AD to address this potential resulting nose-down trim, which could cause the flight crew to have 
difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, 
and possible impact with terrain. 


(f) Compliance 


Comply with this AD within the compliance times specified, unless already done. 
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(о) Revision of Airplane Flight Manual (AFM): Certificate Limitations 


Within 3 days after receipt of this AD, revise the Certificate Limitations chapter of the 
applicable AFM to include the information in figure 1 to paragraph (g) of this AD. 


Figure 1 to paragraph (2) of this AD — Certificate Limitations 


Required by AD 2018-23-51 


Runaway Stabilizer 

In the event of an uncommanded horizontal stabilizer trim movement, 
combined with any of the following potential effects or indications 
resulting from an erroneous Angle of Attack (AOA) input, the flight crew 
must comply with the Runaway Stabilizer procedure in the Operating 
Procedures chapter of this manual: 

e Continuous or intermittent stick shaker on the affected side only. 
Minimum speed bar (red and black) on the affected side only. 
Increasing nose down control forces. 

IAS DISAGREE alert. 

ALT DISAGREE alert. 

AOA DISAGREE alert (if the option is installed). 
FEEL DIFF PRESS light. 

Autopilot may disengage. 

Inability to engage autopilot. 
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(h) AFM Revision: Operating Procedures 


Within 3 days after receipt of this AD, revise the Operating Procedures chapter of the 
applicable AFM to include the information in figure 2 to paragraph (h) of this AD. 


Figure 2 to paragraph (h) of this AD — Operating Procedures 


Required by AD 2018-23-51 


Runaway Stabilizer 

Disengage autopilot and control airplane pitch attitude with control column 

and main electric trim as required. If relaxing the column causes the trim to 

move, set stabilizer trim switches to CUTOUT. If runaway continues, hold 

the stabilizer trim wheel against rotation and trim the airplane manually. 
Note: The 737-8/-9 uses a Flight Control Computer command of pitch 
trim to improve longitudinal handling characteristics. In the event of 
erroneous Angle of Attack (AOA) input, the pitch trim system can trim 
the stabilizer nose down in increments lasting up to 10 seconds. 
In the event an uncommanded nose down stabilizer trim is experienced 
on the 737-8/-9, in conjunction with one or more of the indications or 
effects listed below, do the existing AFM Runaway Stabilizer 
procedure above, ensuring that the STAB TRIM CUTOUT switches 
are set to CUTOUT and stay in the CUTOUT position for the 
remainder of the flight. 
An erroneous AOA input can cause some or all of the following 
indications and effects: 

Continuous or intermittent stick shaker on the affected side only. 

Minimum speed bar (red and black) on the affected side only. 

Increasing nose down control forces. 

IAS DISAGREE alert. 

ALT DISAGREE alert. 

AOA DISAGREE alert (if the option is installed). 

FEEL DIFF PRESS light. 

Autopilot may disengage. 

Inability to engage autopilot. 


Initially, higher control forces may be needed to overcome any 
stabilizer nose down trim already applied. Electric stabilizer trim can be 
used to neutralize control column pitch forces before moving the STAB 
TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be 
used before and after the STAB TRIM CUTOUT switches are moved 
to CUTOUT. 


(i) Alternative Methods of Compliance (AMOCs) 


(1) The Manager, Seattle ACO Branch, FAA, has the authority to approve AMOCs for this 
AD, if requested using the procedures found in 14 CFR 39.19. In accordance with 14 CFR 39.19, 
send your request to your principal inspector or local Flight Standards District Office, as appropriate. 
If sending information directly to the manager of the certification office, send it to the attention of the 
person identified in paragraph (j) of this AD. Information may be emailed to: 9-ANM-Seattle-ACO- 
AMOC-Requests@faa. gov. 
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(2) Before using any approved AMOC, notify your appropriate principal inspector, or lacking 
a principal inspector, the manager of the local flight standards district office/certificate holding 
district office. 


CD Related Information 


For further information about this AD, contact Douglas Tsuji, Senior Aerospace Engineer, 
Systems and Equipment Section, FAA, Seattle ACO Branch, 2200 South 216th St., Des Moines, WA 
98198; phone and fax: 206-231-3548; email: Douglas. Tsuji@faa. gov. 


Issued in Des Moines, Washington, on November 7, 2018. 


Original signed by 

Chris Spangenberg, 

Acting Director, 

System Oversight Division, 
Aircraft Certification Service. 
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APPENDIXC: ECAA EMERGENCY RECOMMENDATION LETTER 
4 


OR TOR? LILA ALBA? айғаст a ETHIOPIAN CIVIL AVIATION AUTHORITY 


Manager, Engineering Quality Assurance Ref 
Ethiopian Airlines 


Addis Ababa 


Subject: Emergency AD 2018-23-51 


Federal Aviation Administration FAA has released an emergency Airworthiness Directive AD 
2018-23-51 which is applicable to B737-8 and -9 airplanes. Accordingly owners and operators 
are required to revise their AFM manual and operating procedure within three (03) days effective 
07 November 2018. 


Hence | would like to inform you that you shall take required actions as appropriate and report to 
the Authority within the specific time period in the emergency AD 2018-23-51. 


With regards, 


Haish Beyene 
P Director, Aircraft Regist: юп an 
per, - к g ж a 
wveoruuness Cert ficater 
CC:- Air Operators Certification 
and Surveillance Directorate 


ECAA, Addis Ababa ошаса m 
64-u-18 , 


Таа 


лаһ жала) Paok) 
Tel.) 011 665 02 00 Telex:) 21162 CIVAIR ET P.O.Box) 978 

hin) 

Fax) (251) 011 665 02 81 ҺАЙ ANT: APR? 
САА 46-100-053 e-mail: address caa.airnav@ethionet.et Addis Ababa:Ethiopia 
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APPENDIX D: BOEING CORRESPONDENCE: MULTI OPERATOR MESSAGES 


FROM: THE BOE 


I 


NG COMPANY 


TO: Boeing Correspondence (MOM) 


[MESSAGE NUMBER:MOM-MOM-18-0664-01B] Multi Operator Message 


MESSAGE DATE: 10 Nov 2018 1810 US PACIFIC TIME / 11 Nov 2018 0210 GMT 


This message is sent to all 737NG/MAX Customers, Regional Directors, 
RegionalManagers and Boeing Field Service Bases. 


CATEGORY: Maintenance, Engineering, Flight Operations, Management, Safety 


SERVICE REQUEST ID: 4-4298138108 


ACCOUNT: Boeing Correspondence (MOM) 


DUE DATE: No Action Required 


PRODUCT TYPE: Airplane 


PRODUCT LINE: 737 


PRODUCT: SEVERAL 


ATA: 0000-57 


SUBJECT: Information - Multi-Model Stall Warning and Pitch Augmentation 


Operation 


REFERENCES: 


/A/ MOM-MOM-18-0655-01B 


SUMMARY : 


Boeing has received many requests for the same information from 737 
fleetoperators in response to th referenc /A/  message.This message 
providestechnical information and operational details. 
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DESCRIPTION: 


A pitch augmentation system function called "Maneuvering Characteristics 


Augmentation System" (MCAS) is implemented оп the 737-8, -9 (MAX) to 
enhancepitch characteristics with flaps UP and at elevated angles of attack. 


TheMCAS function commands nose down stabilizer to enhance pitch 
characteristicsduring steep turns with elevated load factors and during flaps up 
flight atairspeeds approaching stall. MCAS is activated without pilot input and 
onlyoperates in manual, flaps up flight. The system is designed to allow 
theflight crew to use column trim switch ог stabilizer aisle stand 
cutoutswitches to override MCAS input. The function is commanded Бу the 
FlightControl computer using input data from sensors and other Airplane systems. 


The MCAS function becomes activ when the Airplane Angle of Attack exceeds 
athreshold based on airspeed and altitude. Stabilizer incremental commands 
arelimited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. 


The magnitude of the stabilizer input is lower at high Mach number andgreater at 
low Mach numbers. The function is resets once angle of attack fallsbelow the 
Angle of Attack threshold or if manual stabilizer commands areprovided by the 
flight crew. If the original elevated AOA condition persists, the MCAS function 
commands another incremental stabilizer nose down commandaccording to current 
Airplane Mach number at actuation. 


The MCAS function is not incorporated on 737NG Airplanes. 


If you have further questions, you may contact the appropriate Airline 


Support Manager. 


Auto flight Technical Lead Engineer 


Sr. Manager - Systems 


Customer Support 


The Boeing Company 
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APPENDIX E: ECAA GROUNDING OF BOEING 737MAX-8 FLEET 


ZI. 
ж 


P. 
c 


Group Chief Executive Officer 
Ethiopian Airlines Group 


Addis Ababa, Ethiopia 


We are deeply saddened about the loss 9 


lives following crash of Ethiopian Airlines Boeing 


737МАХ-8, Flight number ET-302 on its Scheduled flight to Nairobi departing from Addis 
Ababa Bole International Airport on March 10, 2019. 


Even though it is not possible to rule out anything, it is also impossible to attribute the cause of 


the accident to something at this point of time, the 


accident has some degree of similarity with 


that of the Lion Air accident in which both accidents involved newly delivered Boeing 737-8 


airplanes and happened during take-off phase. 


Hence, this is to officially notify Ethiopian Airlines that its all Boeing 737MAX-8 fleet of 
aircraft is grounded and are not allowed to make commercial flights effective March 11, 2019 
until further notice in consultation with the aircraft manufacturer and State of Design of the 


aircraft. 


Қмму 46 
fe 
T ) 

t 


Au [oS (2. op] 


Sincerely, 


gra 
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APPENDIX F: EASA SAFETY DIRECTIVE 


EASA SD No.: 2019-01 


> AE A 6 А Safety Directive 
SD No.: 2019-01 
ropean Union Aviation Safety Agency шаман: 12 March 2019 


Note: This corrective action to an urgent safety problem is issued by the Agency in accordance 
with Art. 76 (6) of Regulation (EU) 2018/1139. It is mandatory for organisations for which EASA 
is the Competent Authority, including Third Country organisations holding an EASA certificate. 


Subject: Boeing 737-8 MAX and 737-9 MAX - Suspension of Flight Operations 


Effective Date: 12 March 2019, 19:00 UTC 


Supersedure: Not applicable 


Applicability: 
Third Country Operators (TCOs) authorised by EASA pursuant to Commission Regulation (EU) 
No 452/2014 to perform commercial air transport operations with Boeing 737-8 'MAX' or Boeing 


737-9 'MAX' into, within or out of the territory subject to the provisions of the Treaty on European 
Union. 


Definitions: 
For the purpose of this Safety Directive (SD), the following definitions apply: 


None. 


Reason: 

Prompted by a fatal accident with a Boeing 737-8 'MAX' aeroplane, the exact causes of which are 
still being investigated, the Federal Aviation Administration (FAA), representing the State of Design 
for the affected aeroplanes, issued Emergency AD 2018-23-51 (later replaced by a Final Rule AD) to 
require certain changes to the Airplane Flight Manual (AFM) regarding Runaway Horizontal 
Stabilizer Trim Limitations and Procedures. 


Since that action, another fatal accident occurred. At this early stage of the related investigation, it 
cannot be excluded that similar causes may have contributed to both events. Just after the second 
event, the FAA issued CANIC 2019-03, providing information concerning progress on the 
development of mitigating actions. 

Based on all available information, EASA considers that further actions may be necessary to ensure 
the continued airworthiness of the two affected models (Boeing 737-8 ‘MAX’ and Boeing 737-9 
'MAX'). 


For the reasons described above, pending the availability of more information, EASA has decided to 
issue the Emergency Airworthiness Directive referenced below and to require the suspension of 
are 


а Е Р расе 1 nf? 
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EASA SD No.: 2019-01 


commercial air transport operations of the two affected Models into, within or out of the territory 
subject to the provisions of the Treaty on European Union. 


This SD is considered an interim action, and further action is expected to follow. 


Required Action(s) and Compliance Time(s): 
From the effective date and time of this SD, do not perform commercial air transport operations 
with Boeing 737-8 'MAX' or Boeing 737-9 'MAX' into, within or out of the territory subject to the 
provisions of the Treaty on European Union. 


Note: non-commercial operations (e.g. ferry flights) are not within the scope of this SD. 


Ref. Publications: 
EASA AD 2019-0051-E. 


Remarks: 


1. The results of the safety assessment have indicated the need for immediate publication and 
notification, without the full consultation process. 


2. Enquiries regarding this SD should be referred to the EASA Safety Information Section, 
Certification Directorate. E-mail: ADs@easa.europa.eu. 


Dace 2 nf? 
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EASA AD М№о.: 2019-005381 


EIEASA ж. isama 


ufopean Umon Avion Safety Agency 
Issued: 25 March 2019 
Mone Thy Aveo [Bre tive | АЛУ, єт mm esl fy ГАТА, өЛум ж smartare Ath Переа 


U UE 2835/31 19 on lehnt of the Eco pem U moo P Менее Strim aed of те Canoe фес 
Counties (het partycquate vm the жән ties el CASA water Ante 129 af qur Peg eri 


thee AD iiam: Ж oetondores wiit падаро (5$ PANG) ac 23 ^ ЗВ мола wih agocaton ИА) 1421/2004 Annae с, Fart А IDL the 
CRETE Qe prts ei p OF en мет oh ad ве taura Be aig yr зен a^. кы өте ADE Corse qt Dh, fo panyor may вре гаса 26 2а за atas 


an AD шұжа», perp? i» accordance wit* dya reque=rest: ct thet AD, unter зе вағагие zpecihod by Жо Agency Мераба ІЛ 1311/2024 Mewe | 
Fan мА 101 cc ұта afti the Authonty of the Stete of осигу [Rogputamce (EU) 3024/71118. мүк 75 ese mamconi 


Design Approval Holder's Name: Type/Model designation(s): 
THE BOEING COMPANY 737-8 and 737-9 aeroplanes 


| Effective Date: Revision 1- 26 March 2019 
Original issue: 12 March 2019, 19:00 UTC 


TCDS Читтегіз) EASAINM A120 


Foreign AD- None 

| Revision This AD revises EASA Emergency AD 2019-0051-E dated 12 March 2019, 
АТА ~ SUSPENSION OF FLIGHT OPERATIONS 
Manufacturer{s): 


The Boeing Company, Commercial Airplanes Group 


Appiicabdity: 
Model 737-8 and 737-9 (commercially known as МАХ”) aeroplanes, all serial numbers. 


Definitions: 
For the purpose of ths AD, the following definition apply: 


- Ferry flight: Any non-passenger flight conducted after the effective date of this revised AD, 
operating with a permit-to-fly sued under Regulation [EU] 748/2012, Part 21, and under 
flight conditions approved by EASA. 


Reason: 

Prompted by a fatal accident with a Boeing 737-8 МАХ aeroplane, the exact causes of which are 
stili being investigated, the Federal Aviation Administration {РАА}, representing the State of Design 
for the affected aeroplanes, issued Emergency AD 2018-23-51 (later replaced by a Final Rule AD} to 
require certain changes to the Airplane Flight Manual (АРМ) regarding Runaway Horizantal 
Stabilizer Trim Limitations and Procedures. 


71 
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EASA AD No.: 2019-0051R1 


Since that action, another fatal accident occurred. At this early stage of the related investigation, it 
cannot be excluded that similar causes may have contributed to both events. Just after the second 
event, the FAA issued CANIC 2019-03, providing information concerning progress on the 
development of mitigating actions. Based on all available information, EASA considered that further 
actions may be necessary to ensure the continued airworthiness of the two affected models. 


For the reasons described above, pending the availability of more information, EASA issued 
Emergency AD 2019-0051-E to suspend all flight operations of the two affected models. That AD 
allowed a single non-commercial ferry flight (up to three flight cycles) to return the aeroplane to a 
location where the expected corrective action(s) can be accomplished. 


Since that AD was issued, EASA has reconsidered the ferry flight aspects. Consequently, this AD is 
revised to define the conditions under which ferry flights can be performed. 


This AD still is considered an interim action and further AD action is expected to follow. 


Required Action(s) and Compliance Time(s): 
Required as indicated, unless accomplished previously: 


From the effective date of this revised AD, do not operate the aeroplane, except for ferry flights as 
defined in this AD. 


Ref. Publications: 
None. 


Remarks: 


1. If requested and appropriately substantiated, EASA can approve Alternative Methods of 
Compliance for this AD. 


2. Based on the required actions and the compliance time, EASA have decided to issue a Final AD 
with Request for Comments, postponing the public consultation process until after publication. 


3. Enquiries regarding this AD should be referred to the EASA Safety Information Section, 
Certification Directorate. E-mail: ADs@easa.europa.eu. 


4. Information about any failures, malfunctions, defects or other occurrences, which may be 
similar to the unsafe condition addressed by this AD, and which may occur, or have occurred on 
a product, part or appliance not affected by this AD, can be reported to the EU aviation safety 
reporting system. 


5. Fora copy of related service information, if any, contact Boeing Commercial Airplanes, 
Attention: Contractual & Data Services (C&DS), 2600 Westminster Blvd., MC 110-SK57, Seal 


Beach, California 90740-5600, United States of America; Telephone: +1 562-797-1717; 
Internet: https://www.myboeingfleet.com. 
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EASA AD No.: 2019-0051-E 


ES3EASA Emergency Airworthiness Directive 
бере AD No. 2019-0051-Е 


Furopean Union Aviation Safety Agency Issaed 12 March 2019 
u : 


Note: This Emergency Airworthiness Directive (AD) is issued by EASA, acting in accordance with 
Regulation (EU) 2018/1139 on behalf of the European Union, its Member States and of the 
European third countries that participate in the activities of EASA under Article 129 of that 
Regulation. 


This AD is issued in accordance with Regulation (EU) 748/2012, Part 21.A.3B. In accordance with Regulation (EU) 1321/2014 Annex I, Part M.A.301, the 
continuing airworthiness of an aircraft shall be ensured by accomplishing any applicable ADs. Consequently, no person may operate an aircraft to which 
an AD applies, except in accordance with the requirements of that AD, unless otherwise specified by the Agency [Regulation (EU) 1321/2014 Annex I, 
Part M.A.303] or agreed with the Authority of the State of Registry [Regulation (EU) 2018/1139, Article 71 exemption]. 


Design Approval Holder's Name: Type/Model designation(s): 
THE BOEING COMPANY 737-8 and 737-9 aeroplanes 
Effective Date: 12 March 2019, 19:00 UTC 

TCDS Number(s): EASA.IM.A.120 

Foreign AD: None 

Supersedure: Not applicable 

АТА- SUSPENSION ОҒ FLIGHT OPERATIONS 

Manufacturer(s): 


The Boeing Company, Commercial Airplanes Group 


Applicability: 
Model 737-8 and 737-9 aeroplanes, all serial numbers. 


Definitions: 
For the purpose of this AD, the following definitions apply: None 


Reason: 


Prompted by a fatal accident with a Boeing 737-8 ‘MAX’ aeroplane, the exact causes of which are 
still being investigated, the Federal Aviation Administration (FAA), representing the State of Design 
for the affected aeroplanes, issued Emergency AD 2018-23-51 (later replaced by a Final Rule AD) to 
require certain changes to the Airplane Flight Manual (AFM) regarding Runaway Horizontal 
Stabilizer Trim Limitations and Procedures. 


Since that action, another fatal accident occurred. At this early stage of the related investigation, it 
cannot be excluded that similar causes may have contributed to both events. Just after the second 
event, the FAA issued CANIC 2019-03, providing information concerning progress on the 
development of mitigating actions. 
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EASA AD Мо.: 2019-0051-Е 


Based on all available information, EASA considers that further actions may be necessary to ensure 
the continued airworthiness of the two affected models. 


For the reasons described above, pending the availability of more information, EASA has decided to 
suspend all flight operations of the two affected models. 


This AD is considered an interim action and further AD action is expected to follow. 


Required Action(s) and Compliance Time(s): 
Required as indicated, unless accomplished previously: 


From the effective date and time of this AD, do not operate the aeroplane, except that a single 
non-commercial ferry flight (up to three flight cycles) may be accomplished to return the aeroplane 
to a location where the expected corrective action(s) can be accomplished. 


Ref. Publications: 
None. 


Remarks: 


1. Theresults of the safety assessment have indicated the need for immediate publication and 
notification, without the full consultation process. 


2. Enquiries regarding this AD should be referred to the EASA Safety Information Section, 
Certification Directorate. E-mail: ADs@easa.europa.eu. 


3. Information about any failures, malfunctions, defects or other occurrences, which may be 
similar to the unsafe condition addressed by this AD, and which may occur, or have occurred on 
a product, part or appliance not affected by this AD, can be reported to the EU aviation safety 
reporting system. 


4. Fora copy of related service information, if any, contact Boeing Commercial Airplanes, 
Attention: Contractual & Data Services (C&DS), 2600 Westminster Blvd., MC 110-SK57, Seal 
Beach, California 90740-5600, United States of America; Telephone: +1 562-797-1717; 
Internet: https://www.myboeingfleet.com. 
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APPENDIX G:FAA RESCISSION OF EMEREGENCY ORDER OF PROHIBITION 


UNITED STATES DEPARTMENT OF TRANSPORTATION 
FEDERAL AVIATION ADMINISTRATION 


Operators of Boeing Company 
Model 737-8 and 

Boeing Company Model 737-9 
Airplanes 


PEE E 


RESCISSION OF EMERGENCY ORDER OF PROHIBITION 


The Federal Aviation Administration (FAA) Emergency Order of Prohibition issued 
March 13, 2019, applicable to Boeing Company Model 737-8 and Boeing Company Model 737- 
9 airplanes, is rescinded with effect as described below. This rescission enables operation of 
Boeing Company Model 737-8 and Boeing Company Model 737-9 airplanes only upon 
satisfaction of applicable requirements for return to service. 

BACKGROUND 

When the Administrator determines that an emergency exists related to safety in air 
commerce and requires immediate action, the Administrator may issue immediately effective 
orders to meet the emergency. See 49 U.S.C. 8 46105(c). On March 13, 2019, upon receiving 
information indicating the possibility of a shared cause for accidents involving Boeing Model 
737-8 airplanes operated by Lion Air (Flight 610) on October 29, 2018 and Ethiopian Airlines 
(Flight 302) on March 10, 2019, the FAA determined that an emergency existed and issued an 
Emergency Order of Prohibition that restricted the operation of Boeing Company Model 737-8 
and Boeing Company Model 737-9 airplanes. See 84 Fed. Reg. 9705. Following issuance of such 
an order, the FAA is to begin a proceeding immediately about the emergency and give 


preference, when practicable, to the proceeding. See 49 U.S.C. 5 46105(с). 
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BASIS FOR RESCISSION 

The FAA determined that the Lion Air and Ethiopian Airlines accidents involved a 
common cause, identified an unsafe condition that existed in the product and was likely to exist 
or develop in other products of the same type design, and began proceedings to address the 
unsafe condition. On August 6, 2020, the FAA issued a notice of proposed rulemaking (NPRM) 
proposing an Airworthiness Directive that would apply to U.S.-registered Boeing Company 
Model 737-8 and Boeing Company Model 737-9 airplanes and would require owners and 
operators to complete certain corrective action necessary to address the unsafe condition. See 85 
Fed. Reg. 47698. On November 18, 2020, after considering public comments on the NPRM, the 
FAA issued Airworthiness Directive 2020-24-02 as a final rule that requires certain corrective 
action to address the unsafe condition before further flight and conforms the aircraft to the 
amended Model 737-8 and 737-9 type designs that FAA approved on November 17, 2020. The 
Airworthiness Directive will become effective upon its publication in the Federal Register. 

Together, the Airworthiness Directive and the design approval address the unsafe 
condition as to the existing U.S.-registered fleet of Boeing Company Model 737-8 and 737-9 
airplanes and as to any Model 737-8 and 737-9 airplanes for which The Boeing Company 
hereafter seeks airworthiness certificates and export certificates of airworthiness. It is now 
practicable for the FAA to give preference to the proceedings that the FAA began in response to 
the emergency. 

First, the Emergency Order of Prohibition is no longer necessary as to any Boeing 
Company Model 737-8 and 737-9 airplanes that hereafter receive original FAA airworthiness 


certificates and export certificates of airworthiness based on the amended type designs. 
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Second, for any Boeing Company Model 737-8 and 737-9 airplanes not falling into that 
first category, the Emergency Order of Prohibition is unnecessary as to foreign-registered 
airplanes operating in U.S. airspace. With respect to foreign-registered Boeing Company Model 
737-8 and 737-9 airplanes, the FAA will apply Article 33 and Annex 8 of the Convention on 
International Civil Aviation (the Chicago Convention) to take appropriate action to restrict 
access to U.S. airspace and address any non-compliance with U.S. laws where the foreign civil 
aviation authority of the state of registry does not require conformance with the newly amended 
type design or an alternative that achieves at least an equivalent level of safety. 

Finally, upon the publication of Airworthiness Directive 2020-24-02 in the Federal 
Register, the legal force of that Airworthiness Directive will supersede any need to apply the 
Emergency Order of Prohibition as to the existing U.S.-registered fleet of Boeing Company 
Model 737-8 and 737-9 airplanes that the FAA previously certificated. With respect to those 
airplanes, Airworthiness Directive 2020-24-02 requires corrective action before further flight. 

Importantly, in the scenarios identified above, before returning Boeing Company Model 
737-8 and 737-9 airplanes to service, operators must also meet all other applicable requirements, 
such as completing new training for pilots and conducting maintenance activity. 

RESCISSION 

For the foregoing reasons, the March 13, 2020 Emergency Order of Prohibition is 
rescinded as follows: 

(1) effective immediately as to any Boeing Company Model 737-8 and 737-9 airplanes 
that hereafter receive FAA airworthiness certificates and export certificates of airworthiness; 

(2) effective immediately as to any foreign-registered Boeing Company Model 737-8 and 


737-9 airplanes operating in U.S. airspace; and 
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(3) effective upon publication in the Federal Register of Airworthiness Directive 2020- 
24-02 as to all U.S.-registered Boeing Company Model 737-8 and 737-9 airplanes. 


RESCISSION CONTACT OFFICIAL 


Direct any questions concerning this rescission, to Ian Won, Federal Aviation 
Administration, Aircraft Certification Service, Seattle ACO Branch, 2200 South 216" Street, Des 


Moines, WA 98198 (Email: 9-FAA-SACO-AD-Inquiry@faa.gov; Tel: 206-231-3500). 


Dated: 


NOV 1 8 2020 


Steve Dickson 
Administrator 
Federal Aviation Administration 
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APPENDIX H: ETHIOPIAN AIRLINES MESSAGE TO BOEING 


Capt. Yohannes Hailemariam Seifu 


Subject: FW: Questions to Boeing 


From: Webb (US), James D [mailto:james.d.webb4@boeing.com] 
Sent: Monday, December 03, 2018 7:22 AM 


To: Capt. Yohannes Hailemariam Seifu <YohannesHM@ethiopianairlines.com> 


Cc: Bradley (US), Joseph W <joseph.w.bradley@boeing.com> 
Subject: RE: Questions to Boeing 


Good evening Capt. Yohannes, 


І am happy to hear that you were able to take part in the Fleet Team meeting and will 
attempt to answer other questions from your pilots. However, because of our Annex 13 
technical support to the accident investigation, we are unable to answer questions 
directly related to this event. | can only address the current system and the Operations 
Manual Bulletin. The first two questions directly relate to the accident scenario; 
therefore, | will be unable to address them here. | have provided the answer to the third 
question below: 


Third; our third question has to do with the very checklist recommended by the bulletin issued 
regarding the MCAS system. And that is the RUNAWAY STABILIZER checklist. This 
checklist commands the pilot to put the stab trim cut out switches to cut out only if the runaway 
continues after the autopilot is disconnected . But that is not the case with MCAS. MCAS does 
not continually trim down. It stops trimming, according to the bulletin, for 5 seconds if the 
control column trim switches are trimmed in the opposite direction. That will rule out the 
attempt to categorize the malfunction, if it is, as a runaway stabilizer. And by implication the use 
of the checklist. So in short what is the delineation between an MCAS normal operation and 
runaway stabilizer? The purpose of the Operations Manual Bulletin is to raise awareness of the 
relationship between an erroneous AOA indication and uncommanded stabilizer movement. 
Specifically, if the AOA is erroneous and also high, it may be high enough to trigger the MCAS 
flight control law. The pilot always has trim authority to override both the Speed Trim and 
MCAS flight control laws with the control wheel electric trim switches and ultimate authority to 
power off the entire stabilizer trim system using the Stabilizer Cutout Switches. As is stated in 
the OMB, IF uncommanded stabilizer trim movement is experienced in conjunction with the 
erroneous AOA flight deck effects, the instructed course of action is to use the Stabilizer Cutout 
switches per the existing procedure. Additionally, in all phases of manual flight, it is expected 
that flight crews would use normal trim procedures to trim out undesired control forces or 
positions, regardless of axis — stabilizer, rudder, or aileron. 

1 
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If there are other questions with respect to the system or the bulletin, please feel free to 
submit them either to me or through Joe through a BCS message. We will continue to 
assemble the questions coming from other customers and the answers provided back to 
them in an effort to share with everyone the common responses we are providing. 


Captain Jim Webb 
Chief Pilot - 737 
Boeing Test & Evaluation, Seattle, WA 


(206) 225-4371 (Mobile) 


From: Capt. Yohannes Hailemariam Seifu [mailto:YohannesHM@ethiopianairlines.com] 
Sent: Saturday, December 01, 2018 9:15 AM 

To: Webb (US), James D <james.d.webb4@boeing.com> 

Cc: Bradley (US), Joseph VV <joseph.w.bradley@boeing.com> 


Subject: FW: Questions to Boeing 


Dear Capt Webb, 


Following the Webex last Tuesday, the pilots still have some questions to be clarified by 
Boeing. Please find below their questions for your review and answers. We would also 
like to share any relevant question(s) from other operators. 


Best regards, 


From: nathan elias <nthnelias@yahoo.ca> 

Date: November 28, 2018 at 14:35:04 GMT+3 

To: "yohannesh mariam@yahoo.com" <yohannesh mariam@yahoo.com> 
Subject: Questions to Boeing 

Reply-To: "nthnelias@yahoo.ca" <nthnelias@yahoo.ca> 


Dear capt yohannes greetings! ! 
I have sent the same email via company mail but since i had a problem with my 


outlook, i couldn't check if you got the mail. So i have sent you this one again. 
2 
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Having attended the Boeing briefing on the 27th of November, held on a tele 
conferencing, and after mulling on the very precarious situation where the lion air 
crew were, we have come up with few questions mainly related to operations. The 
questions are summarized as follows 


First; According to the briefing there was no problem with the MCAS system at 
the time of the accident except being triggered at the wrong moment during the 
flight due to a single erroneous AOA sensor. Then why is the system designed in 
such a way that it operates depending on a single data source, especially when it is 
of a serious consequences, instead of interrogating data from other AOA sensors? 


Second; Any average skilled pilot experiencing multiple failures, as it were, 
would react to the abnormalities depending on their sequence of urgency. Starting 
with a stick shaker. Because all simulator trainings , so far provided, require at the 
first activation of a stick shaker to react in such a way to curb the impending 
actual stall. It is, though, obvious that all stall warnings are not true as was the 
case with the Lion Air 737 Max involved in the accident. But once a pilot 
identified a stick shaker to be a nuisance, the next thing he would do is the 
AIRSPEED UNRELIABLE memory item. Not runaway stabilizer checklist. 
Because the AIRSPEED UNRELIABLE checklist puts a nuisance stick shaker to 
be an indication of unreliable airspeed. With all these in mind, how can a pilot be 
expected to put the trim cut out switches to cut out before dealing with the above 
procedures unless there is a clear guidance or a QRH procedure addressing such 
scenario? 


Third; our third question has to do with the very checklist recommended by the 
bulletin issued regarding the MCAS system. And that is the RUNAWAY 
STABILIZER checklist. This checklist commands the pilot to put the stab trim 
cut out switches to cut out only if the runaway continues after the autopilot is 
disconnected . But that is not the case with MCAS. MCAS does not continually 
trim down. It stops trimming, according to the bulletin, for 5 seconds if the 
control column trim switches are trimmed in the opposite direction. That will rule 
out the attempt to categorize the malfunction, if it is, as a runaway stabilizer. And 
by implication the use of the checklist. So in short what is the delineation between 
an MCAS normal operation and runaway stabilizer? 


With best regards!! 
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APPENDIX I: NTSB737 MAX 8 SYSTEMS DESCRIPTIONS REPORT 


NATIONAL TRANSPORTATION SAFETY BOARD OFFICE OF AVIATION SAFETY 
WASHINGTON, D.C. 2059 4 

November 27, 2019 

737 MAX 8 SYSTEMS DESCRIPTIONS REPORT 
NTSB ID: DCA19RA101 

A. Accident: 

Operator: Ethiopian Airlines Group 

Location: 28 NM South East of Addis Ababa, Ethiopia 
Date: March 10, 2019 

Airplane: 737 MAX 8, Registration ЕТ-АУ) 

B. Summary: 


On March 10, 2019, Ethiopian Airlines flight 302, a Boeing 737 MAX 8, Ethiopian registration ЕТ-АУ), crashed 28 
NM South East of Addis Ababa, Ethiopia, shortly after takeoff from Addis Ababa Bole International Airport, 
Ethiopia. The flight was a scheduled international passenger flight from Addis Ababa to Jomo Kenyatta 
International Airport, Nairobi, Kenya. All 157 passengers and crew on board died, and the Airplane was 
destroyed. The investigation is being led by the Ethiopia Accident Investigation Bureau.*® 


This document provides a description of the Airplane systems on the 737 MAX 8 which was active during the 
accident flight. 


45Informationinthissectionistakenfromthepreliminaryreportonthisaccident 
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C. 737 МАХ and the Need for MCAS: 


During the preliminary design stage of the 737 MAX 8, Boeing tests and analysis revealed that the addition of 
the LEAP-1B engine and associated nacelle changes produced an Airplane nose-up pitching moment when 
the Airplane was operating at high angles of attack (AOA) and mid Mach numbers. This nose-up pitching 
moment was deemed likely to affect the stick force per g (FS/g) characteristics required by FAR 
25.255 and the controllability and maneuverability requirements of FAR 25.143(f). After a study of 
various options for addressing this issue, Boeing implemented aerodynamic changes on the wing as well as a 
stability augmentation function called the Maneuvering Characteristics Augmentation System (MCAS), as an 
extension of the existing Speed Trim System (STS), to improve Airplane handling characteristics and 
decrease pitch-up tendency at elevated angles of attack. 


As the development of the 737 MAX 8 progressed, the MCAS function was expanded to low Mach numbers. 
MCAS is designed to function only during manual flight (autopilot not engaged), with the Airplane’s flaps 
up, at an elevated AOA. 


D. Pitch Control System Description: 


Pitch control for the Boeing 737 MAX 8 is provided by two elevators and a horizontal stabilizer, 
which are both moveable control surfaces located on the empennage. 


D.1 Elevator System: 


The Boeing 737 MAX 8 elevator control system provides primary pitch control of the Airplane using two 
elevators that are hydraulically powered with manual reversion available in the event of a loss of hydraulics. 
This control system is activated by fore and aft motion of the captain's and first officer's control columns, 
which are connected via a torque tube with a forward cable control quadrant mounted at each end. Elevator 
control cables are routed from the quadrants aft and attach to a pair of aft elevator control quadrants, which 
are mounted on the lower elevator input torque tube. This tube is mechanically connected, via linkages, to 
each of the two power control units (PCUs) input control arm assembly. When rotated, the lower torque tube 
input arm assembly provides a simultaneous command to each PCU to extend or retract. The two PCUs 
operate in unison and are powered by separate hydraulic systems, the left unit from hydraulic system “A” 
pressure and the right unit from hydraulic system B pressure. The output rod of each PCU is connected to the 
upper torque tube, which is directly linked by pushrods to each elevator. 


Aft elevator controls a relocated in he empennage aft of the stabilizer rear spar. 
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D.1.1 Elevator Feel System: 


An elevator feel computer provides simulated aerodynamic forces on the control column based on total 
pressure (from two dedicated pitot probes mounted on the vertical stabilizer) and stabilizer position. 
Feel force is transmitted to the control columns by the elevator feel and centering unit. To operate the feel 
system the elevator feel computer uses either hydraulic system A or B pressure, whichever is higher. 


Stall warning and control is enhanced by the Elevator Feel Shift (EFS) module and the speed trim system. 
The speed trim system is a function within the Flight Control Computers (autopilot) which enhances speed 
stability characteristics. MCAS is a sub function of the speed trim system. These systems work together to 
help the pilot prevent further movement into a stall condition. Higher aft control column forces and the stick 
shaker system provide warning that the Airplane is about to be in or is in a stall condition. 


During high AOA operations, the Stall Management/Yaw Damper (SMYD) reduces yaw damper commanded 
rudder movement. The EFS module increases hydraulic system pressure to the elevator feel and centering unit 
during a stall. This approximately doubles control column forces for a typical stall entry. The EFS module is 
armed whenever an inhibit condition is not present. Inhibit conditions are Airplane on the ground, radio 
altitude less than 100 feet, or autopilot engaged. However, if EFS is active when descending through 100 
feetRA, it remains active until AOA is reduced below approximately stickshaker threshold. There are no 
flight deck indications that the system is properly armed or activated. As airspeed decreases towards stall 
speed, the speed trim system trims the stabilizer nose down and enables MCAS above stickshaker AOA. With 
this trim schedule the pilot must pull more aft column to stall the Airplane. With the column aft, the amount 
of column force increase with the onset of the EFS module is more pronounced. 


D.2 Horizontal Stabilizer System: 


As shown in Figure 1, the horizontal stabilizer controls the pitch trim of the Airplane; its leading edge can be 
moved to a Maximum position of 4.2 degrees up and 12.9 degrees down by the rotation of a jackscrew, which 
is connected to the front spar fitting of the stabilizer via a ball nut. The horizontal stabilizer is positioned by a 
single electric trim motor controlled through either of the stabilizer trim switches located on the pilots’ control 
wheels or autopilot trim. The Speed Trim System, including the Speed Trim function and the MCAS function, 
can also command the trim motor when the autopilot is off. The main electric and autopilot stabilizer trim 
functions have two speed modes; high speed with flaps extended and low speed with flaps retracted. If the 
autopilot is engaged, actuating either pair of stabilizer trim switches automatically disengages the autopilot. 
The stabilizer trim wheels rotate whenever electric stabilizer trim is actuated. 


The stabilizer may also be positioned by manually rotating the stabilizer trim wheels. 
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Figure1: HorizontalStabilizerMovement 


The total range of the Horizontal Stabilizer movement is 17.1 degrees (or units) which is depicted on the 
scale on the stabilizer trim indicator located on the center pedestal in the cockpit. As shown in Figure 2, when 
the stabilizer trim indicator is at the O position, the Horizontal Stabilizer is at its full leading-edge up position 
(Airplane is trimmed full Airplane nose-down). 


STABILIZER TRIM 
INDICATOR 


Figure2: Stabilizer Trim Indicator 
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D.2.1 Stabilizer System — Operation with Autopilot Off: 
D.2.1.1Electric Trim Switch Control: 


Stabilizer trim can be commanded by the flight crew by using electric trim switches located on the outboard 
side of the captain’s and first officers control wheels. Each control wheel contains two switches (arm and 
control) mounted side by side; when activated, the arm switch closes a relay to provide electrical power 
(115V AC) to the stabilizer trim motor; while the control switch provides the directional control to the 
stabilizer trim motor. Both switches (arm and control) must be activated in an Airplane nose up or nose 
down direction in order for the stabilizer trim motor to rotate the stabilizer jackscrew to reposition the 
horizontal stabilizer. 


D.2.1.2Manual Trim Wheel Control: 


Manual stabilizer control is accomplished through cables which allow the pilot to position the 
stabilizer by rotating the stabilizer trim wheels. The stabilizer is held in position by two independent brake 
systems when there is no electric command present to move the stabilizer. Manual rotation of the trim 
wheels can be used to override the brake systems, autopilot, or main electric trim. The effort required to 
manually rotate the stabilizer trim wheels may be higher under certain flight conditions. If the stabilizer trim 
system is actively trimming, grasping the stabilizer trim wheel will stop stabilizer motion. Approximately 15 
rotations of the stabilizer trim wheel are required for each degree (unit) of stabilizer movement. 


D.2.1.3Speed Trim Function: 


The 737 -300, -400 and -500 (737 Classic) as well as the -600/700/800/900 (737 NG) family of 
Airplanesincorporated a Speed Trim System to augment the basic Airplane 's speed stability during certain 
low speed, high thrust flight conditions by moving the horizontal stabilizer during manual flight (autopilot is 
not engaged). The STS was carried over to the 737-7/-8/-9 (737 MAX) family of Airplane s. Additionally, 
on 737 MAXAirplane s, the MCAS function was added to the STS to address the pitch characteristics 
described above 


The Speed Trim function, which is part of the Speed Trim System, is implemented as a control law within 


3 
the flight control computer (FCC ), and commands incremental stabilizer trim through the automatic trim 
control system circuitry.There are two different stabilizer trim rates depending on whether position of the 


4 
flaps. А schedule determines the desired incremental stab deviation from the last trimmed position as a 
function of airspeed and flap position. 


3 The flight control computers (FCC) are part of the Enhanced Digital Flight Control System. 
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D.2.1.4 MCAS Detailed Description: 


The MCAS is a function within the Speed Trim System and, when activated, moves the stabilizer during 
non- normal flaps up, manual flight, high angle of attack maneuvers to provide a desirable increase in stick 
for gradient and a reduced pitch up tendency. Similar to the Speed Trim function, the MCAS function is also 


a flight control [oy caritainéd within each of the two FCCs. MCAS is only active in the master FCC for that 
flight. At Airplane power-up, the master FCC defaults to the left side FCC; and will then alternate between 
the left and right FCC by flight. The master FCC is not affected by the position of the Flight Director 
switches. The FCCs receive inputs from several systems including the Air Data Inertial Reference System 
(ADIRS). Figure 3 Specific to the MCAS, the control law commands the stabilizer trim as a function of the 
following: air/ground signal, flap position, angle of attack, pitch rate, true airspeed and Mach. 
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6 
ReferenceBoeing737 MAXMCASbriefing dated March25,2019. 
"TheSWSoperatesthecontrolcolumnstickshakerstoalertthecrewwhenthe Airplane isnearinganaerodynamic 
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The AOA and Mach inputs are provided to each FCC by the associated air data inertial reference unit 
(ADIRU). Each ADIRU receives AOA information from one of the two resolvers contained within the 
associated AOA sensor (i.e. the Left ADIRU uses left AOA vane and the Right ADIRU uses the right AOA 
vane). Information from the other resolver contained within the AOA sensor is provided to the Stall 
Management Yaw Damper Computer (SMYD), which is used, along with data from other sources, for the 
purpose of calculating and sending commands to the Stall Warning System (SWS) ’ 


As originally delivered, the MCAS became active during manual, flaps-up flight (autopilot not engaged) 
when the AOA value received by the master FCC exceeded a threshold based on Mach number. When 
activated, the MCAS provided a high rate automatic trim command to move the stabilizer AND. The 
magnitude of the AND command was based on the AOA and the Mach. After the non-normal maneuver 
that resulted in the high AOA, and once the AOA fell below a reset threshold, MCAS would move the 
stabilizer ANU to approximately the original position and reset the system. At any time, the stabilizer inputs 
could be stopped or reversed by the pilots using their yoke-mounted electric stabilizer trim switches, and 
then the MCAS system will reset after a 5 second delay. 


The latter behavior is based on the assumption that flight crews use the trim switches to completely return 
the Airplane to neutral trim. In the FCC software version current at the time of the accident, if the original 
elevated AOA condition persists for more than five seconds following an MCAS flight control law reset, the 
MCAS flight control law will command another stabilizer nose down trim input (with the magnitude based 
on the AOA and Mach sensed at that time). 


On all 737 models, column cutout switches interrupt stabilizer commands, either from the auto flight system 
(e.g. FCC) or the electric trim switches in a direction opposite to elevator command. On the 737NG and 
MAX, two column cutout switching modules, one for each control column, are actuated when the control 
columns are pushed or pulled away from zero (hands off) column position. When actuated, the column 
cutout switching modules interrupt the electrical signals to the stabilizer trim motor that are in opposition to 
the elevator command. 


The MCAS function requires the stabilizer to move nose down in opposition to the column commands when 
approaching high angles of attack. То accommodate MCAS, the column cutout function in the first 
officer's switching module was modified to inhibit the aft column cutout switch while MCAS is active, 
allowing Airplane nose-down (AND) stabilizer motion with Airplane nose-up (ANU) column input. Once 
MCAS is no longer active, the normal column cutout function in the stabilizer nose down direction is re- 
instated. 
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D.2.2 Stabilizer System — Operation with Autopilot On: 


When an autopilot is engaged, the trim commands are intended to move the stabilizer in the direction to 
reduce the amount of trim held by the elevators. With flaps up, the stabilizer trims at .09?/s and with flaps 
down, the rate is 0.27°/sec. 


D.3 Stabilizer Trim Cutout Switches: 


There are two stabilizer trim cutout switches located next to each other on the aisle stand just aft of 
the flap lever. They are identified as the STAB TRIM PRI (stabilizer trim primary) cutout switch and the 
STAB TRIM B/U (stabilizer trim back up) cutout switch. If either switch is positioned to CUTOUT, power 
is removed from the stabilizer trim motor and neither main electric trim nor automatic trim can move the 
stabilizer. 


E. Air Data Inertial Reference System: 


The Boeing 737 MAX 8 is equipped with an Air Data Inertial Reference System (ADIRS) that provides 
flight data to the flight deck display panels, flight management computers, flight controls, engine 
controls and all other systems requiring inertial and air data information. The ADIRS combines the 
Air Data System (ADS) function and the Inertial Reference System (IRS) function into a single 
device identified as an Air Data Inertial Reference Unit (ADIRU). The ADIRUs provide inertial 
position and track data to the flight management system and provide attitude, altitude and airspeed data 
to the flight deck displays. The ADIRUs process information measured by internal gyros and accelerometers 
and information from the air data sensors. 


E.1 Pitot and Static System: 


The pitot static system is comprised of three separate pitot probes and six flush static ports; two of 
these pitot probes and four of the static ports interface with the Air Data Modules (ADM), which convert 
pneumatic pressure to electrical signals and send these data to the ADIRUS. The remaining auxiliary 
pitot probe and alternate static ports provide pitot and static pressure to the standby instruments. The 
auxiliary pitot probe is located on the first officer's side of the Airplane. 


The ADM connected to the Captain's pitot probe sends information to the left ADIRU, while the 
ADM connected to the First Officer's pitot probe sends information to the right ADIRU. The remaining 
ADMs are located at the balance centers of the Captain's and First Officer's static ports. The ADM 
connected to the Captain's static ports sends information to the left ADIRU for display of the captain's 
instruments, while the ADM connected to the First Officer's static ports sends information to the right 
ADIRU for display on the first officer's instruments. 
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The data from the ADIRU is processed by the Display Processing Computer (DPC) in the MAX 
Display System. The Boeing 737 MAX 8 has two DPCs. The DPC receives ARINC 429 digital data and 
analog discrete from various Airplane systems. The DPCs processes these data to be displayed on the 
Display Units (DU) located within the flight deck. Both DPCs receive data from both the left and right 
ADIRU and either DPC is capable of driving the captain's and first officer's displays. 


E.1.1 Air Data Reference (ADR): 


The Air Data Reference (ADR) function of the ADIRU is to sense the Airplane ’s pitot and static 
pressures external to the Airplane and convert them into digital electrical signals. These pressures, in 
conjunction with the Total Air Temperature (TAT) and the Airplane's AOA are used by the ADIRU to 
calculate basic air data information (parameters) for transmission to various systems оп the Airplane. 
Some of the parameters that the ADIRU transmits include: altitude, computed airspeed, and true airspeed. 
Another function of the ADIRU is to provide AOA information (corrected angle of attack) directly to 
the Flight Control Computers as an input to the MCAS function. 


Both the altitude and airspeed use static pressure which includes calculations for a correction factor of the 
Static Source Error Correction (SSEC).This is a compensation for pressure errors caused by the airframe's 
aerodynamic effects on the static port. The static ports have been located to minimize errors. Compensation 
for the remaining errors is provided by a correction algorithm comprised of three factors: basic correction, 
thrust effect compensation and ground effects compensation. 


FIO 
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Figure4: BlockDiagramoftheAirDataInertialReferenceSystem 
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E.2 Altitude and Airspeed PFD Indications: 


In the event of certain system failures, the ADIRU output data provided to other systems, including the 
Display Processing Computer (DPC), may become invalid, e.g. No Computed Data (NCD) or Failure 
Warning (FW). In response, the Primary Flight Display (PFD) may show a flag on the particular parameter 
(ALT, SPD, ATT, etc.) with amber color and/or the particular parameter will not be shown in the PFD. 


The ALT and/or SPD flags will appear on the PFD if the altitude and/or computed airspeed data from the 
ADIRU is invalid. The respective altitude and/or computed airspeed data will not be shown on the PFD. 
These parameter flags are shown in Figure 5 below 


Figure5: InstrumentSPDandALTFlagsAppearonPFD 


In the DFDR, there is no discrete parameter indicating that the SPD flag is being displayed. However, if 
either the DFDR parameter of computed airspeed (CAS) left or right shows the characteristic “saw tooth” 
pattern, that indicates an invalid data status from which it can be concluded that the SPD flag is being 
displayed on Captain or First Officer primary flight display (PFD). 


ALT Flag (amber) means the altitude display has failed. In the DFDR, there is no discrete parameter 
indicating that the ALT flag is being displayed. However, the DFDR records four parameters of barometric 
altitude on each altimeter. If these altitudes are marked by the ADIRU as invalid, the DFDR records a “saw 
tooth" error pattern from which it can be concluded that the ALT flag is being displayed on captain's or 
FO's PFD. 
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If the airspeed or altitude values from the left and right ADIRU diverge sufficiently for a certain period of 
time, the corresponding disagree message will be displayed on both PFDs. 


Airspeed Disagree Alert (amber) Altitude Disagree Alert (amber) 


Figure 6: IAS and ALT Disagree Messages on the PFD 


Тһе AIRSPEED LOW annunciation alerts the flight crew of low air speed. The alert is ап Airplane 
operational alert that is calculated by the Enhanced Ground Proximity Warning System (EGPWS) and the 
MAX Display System which occurs when the computed airspeed (from the ADIRU) falls below threshold 
airspeed between the minimum maneuver speed and stick shaker speed. 


The aural alert coincides with the low airspeed alert on the airspeed indication. The minimum maneuver 
speed is indicated by the top of the amber bar on the PFD when the Airplane is in flight. This airspeed 
provides: 


* The 1.3 g maneuvere capability to stick shaker below approximately 20,000 feet. 


* The 1.3 g maneuver capability to low speed buffet (or an alternative approved maneuver capability set in 
the FMC maintenance pages) above approximately 20,000 ft. 


The minimum speed is indicated by the red and black barber pole. The top of barber pole indicates the speed 
at which stick shaker occurs. 


302 


Aircraft Accident Investigation Report В737- MAX 8, ЕТ-АУ) December 
2022 


Minimum Maneuver Speed (amber) 


Minimum Speed (red and black) 


Figure7: MinimumManeuverSpeedandMinimumSpeedIndicationsonthePFD 


The Maximum operating speed (Maximum Mach operating speed (Mmo) or Maximum operating speed 
(Vmo)) is displayed by the red and black barber pole warning band and the Maximum maneuver speed is 
displayed by the amber bar on top of the speed tape indication on the PFD. The Maximum operating speed is 
shown in Figure 8 below. The bottom of the barber pole indicates the Maximum speed as limited by the 
lowest of the following: 


* Vmo/Mmo 
* Landing gear placard speed 
* Flap placard speed 


When an over-speed condition occurs, a clacker aural warning will active. The warning clackers can be 
silenced only by reducing airspeed below Vmo/Mmo. 
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Maximum Operating Speed (red and black) 


Figure8: Maximum OperatingSpeed 
Е.З Angle of Attack (АОА) Sensors 


The Boeing 737 МАХ 8 has two independent angle-of-attack (AOA) sensors, one on each side of the 
forward fuselage. The AOA sensors consist of an external vane which rotates to align with the local airflow 
connected to two internal resolvers which independently measure the rotation angle. 


AOA SENSOR 


ALIGNMENT PIN 
(2 LOCATIONS) 


Figure9: AngleofAttack (AOA) Sensor 
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For each AOA sensor (left and right), one resolver is connected to the respective Stall Management Yaw 
Damper (SMYD) computer and the second resolver is connected to the respective ADIRU. Both the SMYD 
and ADIRU monitor the resolvers within the AOA sensor for short or open circuits. If a fault is detected, the 
AOA resolver information is not used and the fault will result in the ALT and SPD flags being displayed on 
the PFD. 


There is no scheduled maintenance for AOA sensors. Any required maintenance is a consequence of 
annunciated faults or observed malfunctions. This practice is Known as “on-condition” maintenance. 


E.3.1 AOA Display Option 


Boeing provides the option for the operator to install the AOA indicator on the PFD for Boeing 737 MAX 8. 
The respective PFD will show the AOA information as shown in Figure 10 below 


gus 
122.95 ( In: 
1200 ) 
80-01 Хх” 
11065 00:00 


15: 367 O2NOV11 00:00 


Angle of 


Attackindicato 


Figure10:AOA Indicator on PFD 


As shown in Figure 11 the AOA DISAGREE message appears on the captain's and first officer's PFDs 
when the values of the left and right AOA transmitted by the ADIRUs sufficiently diverge. The 
annunciation is only displayed in the air because AOA values are unreliable when the Airplane is stationary 
on the ground. 
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AOA Disagree Alert 
(amber) 


Figure11:AOA Disagree Message on the PFD 


The AOA DISAGREE message was first implemented on the Boeing 737 NG fleet in 2006 in 
response to customer requests. Since 2006, the AOA DISAGREE alert has been installed on all newly 
manufactured Boeing 737 NG Airplane and is available as a retrofit for older Airplane. The requirements for 
the AOA DISAGREE alert were carried over from the Boeing 737 NG to the Boeing 737 MAX 8. In 2017, 
however, within several months after beginning Boeing 737 MAX 8 deliveries, Boeing identified that 
the 737 MAX 8 display system software did not correctly implement the AOA DISAGREE alert 
requirements. As with the Boeing 737 NG, the Boeing display system requirements for the 737 MAX 8 
called for the activation of the AOA DISAGREE alert as a standard feature on all Airplanes. The software 
delivered to Boeing, however, linked the AOA DISAGREE alert to the AOA position indicator, which is an 
optional feature on the Boeing 737 MAX series. Accordingly, the software activated the AOA DISAGREE 
alert only if an airline opted for the AOA indicator. At the time of the accident, Boeing advised that the 
AOA indicator has been selected by approximately 20% of airlines. 


Boeing advised that new software implementing the AOA DISAGREE alert will be available before the 
737MAX 8 Airplane returns to service. 


F. Autopilot, Flight Director, and Autothrottle: 


The Boeing 737 MAX 8 is equipped with an Enhanced Digital Flight Control System (EDFCS). Тһе 
EDFCS system on the 737 MAX 8 is the same as the 737 NG with the following added functionality in the 
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flight control computer (FCC) software: 1) Maneuvering Characteristics Augmentation System 
(MCAS), 2) Emergency Descent in Autopilot and Flight Level Change Mode, 3) Spoiler Control 
Electronics Interface, and 4) Autopilot Roll Command Alerting System. The EDFCS provides integrated 
operation of the following major flight control functions: 


The AOA DISAGREE message was first implemented on the Boeing 737 NG fleet in 2006 in 
response to customer requests. Since 2006, the AOA DISAGREE alert has been installed on all newly 
manufactured Boeing 737 NG Airplanesand is available as a retrofit for older Airplane. 


The requirements for the AOA DISAGREE alert were carried over from the Boeing 737 NG to the Boeing 
737МАХ 8. Іп 2017, however, within several months after beginning Boeing 737 MAX 8 
deliveries, Boeing identified that the 737 MAX 8 display system software did not correctly implement the 
AOA DISAGREE alert requirements. As with the Boeing 737 NG, the Boeing display system requirements 
for the 737 MAX 8 called for the activation of the AOA DISAGREE alert as a standard feature on all 
Airplanes. The software delivered to Boeing, however, linked the AOA DISAGREE alert to the AOA 
position indicator, which is an optional feature on the Boeing 737 MAX series. Accordingly, the software 
activated the AOA DISAGREE alert only if an airline opted for the AOA indicator. At the time of the 
accident, Boeing advised that the AOA indicator has been selected by approximately 2096 of airlines. 
Boeing advised that new software implementing the AOA DISAGREE alert will be available before the 737 
MAX 8 Airplane returns to service. 


F. Autopilot, Flight Director, and Autothrottle: 


The Boeing 737 MAX 8 is equipped with an Enhanced Digital Flight Control System (EDFCS). Тһе 
EDFCS system on the 737 MAX 8 is the same as the 737 NG with the following added functionality in the 
flight control computer (FCC) software: 1) Maneuvering Characteristics Augmentation System 
(MCAS), 2) Emergency Descent in Autopilot and Flight Level Change Mode, 3) Spoiler Control 
Electronics Interface, and 4) Autopilot Roll Command Alerting System. The EDFCS provides integrated 
operation of the following major flight control functions: 


* Altitude Alert 

e Autopilot (including Autoland) 
* Flight Director 

* Speed Trim 

* Mach Trim 


* Maneuvering Characteristics Augmentation System (MCAS) 
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* FMC Interface & Mode Control 


* Autothrottle Interface, NI Limits, & Mode Control (for those Airplanesequipped with a separate 
external auto throttle computer) 


The EDFCS has a mode control panel (MCP), two FCC's, and actuator inputs to the flight control system. 
The MCP is the primary interface between the flight crew and the FCCs. The FCCs get inputs from several 
systems such as the Air Data Inertial Reference System (ADIRS) and the Flight Management Computer 
(FMC) and sends commands to the aileron and elevator actuators. These actuators control the movement of 
the ailerons and elevators, which control the flight path of the Airplane. There are two autopilots, autopilot 
A from FCC А and autopilot B from ЕСС B. When you engage an autopilot from the MCP, the autopilot 
can control the Airplane attitude through these phases of flight: Climb, Cruise, Descent, Approach, Go- 
around and Flare. 


F.1 Autopilot 


The autopilot is engaged by selecting one of two autopilot push button engage switches located near the 
right edge of the MCP, between the Vertical Speed display window and the right hand Flight Director toggle 
switch. The control column force must be less than 5 165. and the control wheel force must be less than 3 165. 
for the autopilot to engage. If the forces exceed these values, then attempting to engage the autopilot 
results in an autopilot disconnect warning. 


The normal autopilot disengagement mechanism is via the quick disconnect pushbutton switches on the 
captain's and first-officer's control wheels. An alternate disengage mechanism is provided by the disengage 
bar located on the bottom edge of the MCP just below the engage buttons. An amber strip is exposed when 
the bar is down to positively indicate activation of the disengage bar. Pressing a lighted engage pushbutton 
also disconnects the autopilot (except when dual engaged for fail operational autoland—in this case only the 
corresponding channel disconnects). 


Certain failures of the EDFCS or interfacing systems will cause the autopilot to automatically disconnect 
when the failure occurs. The autopilot may also automatically disconnect upon use of certain source select 
switches but can (sometimes) be reengaged. 


Upon autopilot disconnect, the autopilot disengage light on the Autoflight Status Annunciator will 
indicate disconnect by flashing red. The annunciator is located just above both the Captain's and First 
Officer's Secondary EFIS displays. This will be accompanied by an aural warning. The pilot may reset the 
warnings by pressing the autopilot disengage switch on the wheel or the light on the Warn Annunciator. The 
warning will continue for 2 seconds regardless of how quickly the pilot might reset the warning. The 
disengage light will illuminate steady red for the following conditions, indicating that the pilot should 
disengage the autopilot or that it is unusable: 
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* Altitude Acquire inhibited from autopilot go-around due to elevator position being beyond single 
channel authority. 


* A detected failure of the FCC/MCP Interface during autopilot go-around 
* The system is in BITE mode. 
* Stabilizer is out of trim during dual channel approach below 800' R/A. 
* Incompatible FCC part numbers. 
F.2 Flight Director 


Selecting a Flight Director toggle switch to the ON position activates the Flight Director. The left switch 
enables the Flight Director Command bars on the captain's primary EFIS display. The right switch enables 
them on the first officer's display. When a Flight Director is initially selected ON, the bars will be out of 
view and there will be no active mode. Subsequent use of the TOGA switch or an MCP mode selection will 
bring the bars into view. 


The Flight Director Master light located next to the switch indicates which baro correction is currently in- 
use by the autopilot/Flight Director for calculations such as Altitude Alert or Altitude Acquire. Under 
normal operations, the left FCC provides the Flight Director commands for the left display and the 
right FCC provides similar commands for the right display. The Flight Director Command bars are biased 
out of view in the event of a mode failure. Flight Director Selection is annunciated by a green “FD” on the 
primary EFIS display when the autopilot is not engaged. Flight Director Modes may be engaged and used 
alone or may be displayed in conjunction with autopilot operation. 


F.3 Autothrottle 


The auto throttle (A/T) system provides automatic thrust control from the start of takeoff through climb, 
cruise, descent, approach and go-around or landing. The A/T system controls engine thrust in response to 
the mode selected by the flight crew through the EDFCS, Mode Control Panel (MCP), Flight 
Management Computer (FMC) and ADIRU. The speed information taken from the ADIRU is used to 
calculate throttle lever rate commands to set engine thrust during changing flight conditions. All the 
information is processed by FCC A, which provides commands to the thrust lever servo motors controlling 
thrust lever movement. 


The auto throttle Arm switch is a magnetically held two-position switch, located on the left side of the MCP, 

between the IAS/MACH display window and the left Flight Director toggle switch. Arming the A/T is 

preparing the system to engage іп the NI, MCP SPD, ог FMC SPD mode. A green light near the auto 

throttle Arm switch is illuminated when the auto throttle Arm switch is in the ARM position. In the ARM 
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state the auto throttle will accept mode requests from the autopilot or TOGA switch and engage the 
appropriate auto throttle mode. While on the ground, the FMC must be in the takeoff mode for the auto 
throttle Arm switch to hold in the ARM position and arm the system. Moving the auto throttle Arm switch 
to OFF or activating an auto throttle quick disengage switch (which causes the auto throttle Arm switch 
to move to the OFF position) disconnects the auto throttle. There is an auto throttle quick disengage 
switch installed on the outside edge of each thrust lever. Four auto throttle modes are available: N1, Speed, 
Go-Around and Retard. For each flight phase the flight crew can select the А/Т МІ or speed modes from the 
MCP or directed by the FMC. During takeoff, pushing TO/GA switch engages the A/T in МІ mode and 
causes the engine thrust to increase to the takeoff (TO) N1. 


Mode Function 


Speed Maintain a user-selected speed. Throttle will be controlled 
from idle up to the N1 thrust limit shown on the EICAS display 
as needed. Throttle movements occur at a slow throttle rate. 


N1 Maintains thrust at the full N1 limit. 
Go-Around Advances thrust sufficient for a reasonable climb. Further 


advances thrust to G/A limit if TOGA switch pressed a second 
time. 

Retard Retard throttles to idle during level change descents and flare. 
Throttle Hold Holds thrust lever position (autothrottle servomotors 
depowered) during takeoff when speed exceeds 80kts to 
protect against autothrottle erroneous retard failures. 


Figure12:AutothrottleModes 
G. Stall Warning: 


Natural stall warning (buffet) usually occurs at a speed prior to stall. Іп some configurations the 
margin between stall and natural stall warning is less than desired. Therefore, an artificial stall warning 
device, а stick shaker, is used to provide the required warning. 


Each control column has an eccentric weight motor which can vibrate the column to alert the pilots before 
astall develops. The system is armed in flight at all times. The system is deactivated on the ground, except 
during the ground test. Two independent, identical SMYD computers determine when stall warning is 
required based upon: 


Alpha vane angle of attack outputs 
ADIRU outputs 
Anti-ice controls 
Wing configurations 
Air/ground sensing 
310 


Aircraft Accident Investigation Report В737- MAX 8, ЕТ-АУ) December 
2022 


Thrust 
FMC outputs 


The AOA sensor is connected to the SMYD and provides the measured angle of the direction of airflow 
relative to the fuselage. If the AOA sensor detects an excessive angle of attack compared to the design 
characteristic of the 737 MAX 8, the SMYD will activate the stick shaker to provide aural and tactile 
alert to the flight crew. 


Two SMYD computers provides output for stall warning to include stick shaker, Pitch Limit 
Indicator, and maneuver and operating airspeed limits. The No.1 SMYD activates the Captain’s stick 
shaker, and the No. 2 SMYD activates the F/O stick shaker. Vibrations from either stick shaker can 
be felt in both columns through the mechanical column interconnect. 


H. Enhanced Ground Proximity Warning System (EGPWS): 


The Enhanced Ground Proximity Warning System (EGPWS) provides the aural alert “Bank Angle" when 
excessive roll of the Airplane occurs. The alert is based on radio altitude and bank angle under the following 
conditions: 


* From 5 feet to 30 feet AGL, the alert sounds when the bank angle exceeds 10 degrees 


* From 30 feet to 130 feet AGL, when the alert sound varies linearly from a bank angle of 10 
degrees at 30 feet AGL, to a bank angle of 35 degrees at 130 feet AGL 


* Above 130 feet AGL, the alert sounds when the bank angle exceeds 35 degrees. 


A "Don't Sink" aural is generated by EGPWS Mode 3. Mode 3 provides alerts for excessive altitude loss 


after takeoff. Mode 3 is based primarily on radio altitude, altitude, and altitude rate?. The Mode 3 alerting 
envelope is a function of radio altitude and altitude loss. The amount of altitude loss required for an alert 
varies as a function of flight profile and time. 


8AltitudeusedforMode3isIRUinertialaltitude, internallycomputedinertialaltitude,or ADC barometric altitude 


?AltituderateusedforMode3isIRUinertialverticalspeed, internally computed inertial altituderate, or ADC 
barometric altitude rate 
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APPENDIX J: FDR AND CVR EXAMINATION 
The FDR was first visually examined. The chassis was damaged and folded on itself. The acquisition boards 
were visible as well as some internal connectors. The protected module Crash Survival Module Unit (CSMU) was 
still attached to the chassis and presented scratches. There was no ULB attached to the CSMU. A recorder 
identification plate was found close to the CSMU on the chassis, but not fixed to the chassis, on which the 
following numbers were written: P/N 2100-4945-22, S/N 001217995 


| 


FIGURE 1: FDR FOUND IN THE SUITCASE BROUGHT BY ETHIOPIAN EAIB 


As the chassis and the CSMU were damaged, it was decided to open the CSMU to extract the memory puck. The 
CSMU was unscrewed from the chassis. The interface board located under the CSMU was damaged. The flex 
connector between the interface board and the memory puck was found broken and the flex between the 
interface board and the chassis was also found broken. 


The identification located under the CSMU was P/N 253-E5675-05 and S/N 001230922. According to Model 
FA2100 FDR CMM, published by L3, version Fev 2018, the part number 253E5675-05 corresponds to a FDR 
CSMU of 2GB NAND memory. The identification sticker under the CSMU confirmed that this recorder was a FDR. 
In addition, the identification plate found on top of the recorder confirmed that this was the FDR of ET-AVJ 
Airplane. 

The cover of the CSMU was unscrewed. The insulation material inside the CSMU was no longer compact and it 
was scooped out to access the memory puck. 
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FIGURE 2: AT OPENING THE FDR CSMU, SHOWING THE MEMORY PUCK AND FLEX 


It was first attempted to extract the memory puck by gently pulling on the flex. It was found that the 
connector was not properly attached to the memory puck. 


The memory puck was opened and the electronic board containing the memory component support was 
extracted. The memory board identification was P/N 205-E5458-04, S/N 001157901 and the flex 
identification was 024-E5675-20 REV, 1809-1. 


FIGURE3: FDR MEMORY BOARD, FLEX AND CONNECTOR 
The memory board was visually inspected with a Keyence microscope. Apart from the connector pads, 


the memory board was in good condition. There was no trace of impact. The two memory chips as well 
as the micro-processor were found in good condition. 
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205 — E5458 — 04 


001157901 - 
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FIGURE 4: FDR MEMORY BOARD 
At the connector location on the memory board the first 8 pads (on Figure 4)) were found missing. The holes 
were filled with insulation dust. The last 12 pads were in good condition. 


When examining the flex and connector, it was found that the missing pads from the memory board had 
migrated to the connector pins. There were also pieces of PCB material on the connector pins. 


АЛЫМ 17777717 


Figure5: Pads and pieces of PCB material on the connector pins j 
The FDR memory board was also inspected with the X-ray machine. This confirmed that the first 8 pads 


of the connector were missing on the memory board (Figure 4) and that the 12 others were in good 
condition. There was continuity between those 12 pads and their vias (left side on Figure 4). 
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2019.08.15 16-43 


This confirmed that data extraction operations could not be performed without re-soldering a new connector 
on the memory board. 


Discussion with the recorder manufacturer 

On March 15th, following the opening operations of the FDR, it was decided to consult the recorder 
manufacturer L3. The objective was to present a repair proposal with a connector from a similar new 
unit, to obtain an agreement from L3 to proceed and have mapping information on the connector. 
During the conference call, L3 confirmed that the repair proposal was adequate to repair the board. 

L3 also confirmed that the two versions of the flex cable, cable 024-E5675-02 REV and cable 024-E5675- 
20 REV are interchangeable. The new version -20 was developed to enhance the resistance of the flex. 


L3 confirmed late evening on March 15th that the 8 missing pads (1 to 8) were not necessary for the 
download of the data. Pins 1 to 6 are used for programming the memory and pins 7 and 8 are reserved 
for future use. 

On March 16th, all parties agreed that it was only necessary to resolder the last 12 pins of a new 
connector (pins 9 to 20, on the left side of Figure 10) to the FDR memory board to download the data. 
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FDR data validation 
The binary file was synchronized with the BEA software used for FDR analysis (LEA). It was a 1024 WPS, UPK, 
and Teledyne. In total there was 18 synchronized zones and a total of 264 569 seconds were synchronized, 
corresponding to more than 73 hours. The synchronization rate was 99.980796. 
Validation of parameters 
The FDR data were decoded using the Boeing data frame described in the document Digital flight data 
acquisition unit 737 MAX Data frame interface control and requirements document, reference 02264101-6, rev E 
dated 10th January 2019. NTSB provided this data frame document on March 13th, 2019. 
The validation of the data extraction was made using the following parameters 

- Altitude 101325mb Left & Right / Radio height Left & Right 


- Computed airspeed Left & Right / Ground speed 
- CMDA/ CMDB 

- Control Column Position Capt & FO 

- Control Column Force Pitch Capt & FO 

- Elevator Position Left & Right 

- Angle of Attack Indicated Left & Right 

- Stick Shaker Left & Right 

- Pitch Trim Position 

- Trim up Manual / Trim up AP / Trim Down Manual / Trim Down AP 
- Flap Handle Position 

- Pitch angle right 

- Inertial Vertical Speed 

- Vertical Acceleration 


- Longitudinal Acceleration 
Description of the validation 
The validation focus was made on the last 10 minutes of recorded data. All parties agreed that the events of the 
accident flight were present in the FDR. 
As the validation process, a focus was made on the angle of attack parameters. The left and right angle of attack 
parameters showed significant differences during the accident flight. Those two parameters showed similar 
values during the end ofthe previous flight (and were within coherent range). 
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FIGURE 7: ЕТ-АУ) FDR MEMORY BOARD WITH INTERFACE BOARD CONNECTOR FROM BEA SURROGATE RECORDER (LEFT), BEA SURROGATE 
RECORDER MEMORY BOARD WITH ORIGINAL CONNECTOR (RIGHT), BOTH MOUNTED WITH FLEX CABLE PIN VISIBLE AND "P1" WHEN PERFORMING 
READOUT 


CVR EXAMINATION 

2.1. Opening 

The CVR CSMU was already separated from its chassis when it was brought to the BEA facilities. There was no 
ULB attached to it and no identification plate was found on the CSMU. 

The isolated chassis was damaged and still partially attached to the Airplane rack on which it was mounted. 
There was no identification plate on it. Wires were visible on the back side. 


= SÉRIE: 


ma NE PME 


FIGURE: 8 CVR CSMU AND CHASSIS WHEN BROUGHT BY ETHIOPIAN EAIB 


The CSMU case showed an opening. The hole on the side opposite to the ULB fixation allowed seeing the 
internal insulation material 
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FIGURE 9: CVR WHEN OPENING THE SUITCASE BROUGHT BY ETHIOPIAN EAIB 


The interface board that is supposed to be located under the CSMU was missing and the flex connecting it to the 
memory puck was damaged. 

It was decided to open the CSMU to extract the memory puck. The first 3 screws were removed but it was not 
possible to remove the last one due to deformation of the screw head. The cover was slid to allow the removal 
of the memory puck. The insulation material inside the CSMU was no longer compact and it was scooped out. 


The memory board identification was P/N 205-E5458-04, S/N 001158644 and the flex identification was 024- 
E5675-20 REV, 1809-1. 


FIGURE 10: CVR MEMORY BOARD AND FLEX 


The CVR memory board and flex were visually inspected with the Keyence microscope. There was no damage 
on the board and the connector was in good condition. 

A second observation with the X-ray was made, which confirmed that the connector soldering were in good 
condition. 
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APPENDIX K: BOEING RESPONSE 
Boeing Response to Recommendation1 
FSBR-B737-Rev-17 


PILOT TRAINING 

9.1 Airman Experience. Airmen receiving initial, differences, upgrade, or transition training are assumed to 
have previous airman experience. Applicable previous experience may include multiengine transport turbojet 
airplane, new generation avionics, high altitude operations, military, or flight management system (FMS). Pilots 
without this experience may require additional training. 


9.2 Special Emphasis Areas. 


Note: References to "pilots" in this section include both pilots in command (PIC) and seconds in command (SIC) 
unless otherwise specified. 


9.2.1 Pilots must receive special emphasis on the following areas during ground training: 

9.2.1.1 Multiple flight deck alerts during non-normal conditions. Training must include instances where a single 
malfunction results in multiple flight deck alerts, and flight crew alert prioritization and analysis of the need to 
conduct additional NNCs. This training must be included in initial, upgrade, transition, and recurrent training. 


9.2.1.2 Automatic landings. When an operator is authorized for autoland operations, ground training is required 
during a preflight briefing prior to flight training. This item must be included in initial, upgrade, transition, 
differences, and recurrent training. The 737NG and 737 MAX autoland systems are identical and do not require 
differences training unless transitioning between the Fail Passive system and the Fail Operational system. 


9.2.1.3 Enhanced Digital Flight Control System (EDFCS). When an EDFCS that supports Fail Operational 
autoland operations with a Fail Passive Rollout system is used, ground training is required during a preflight 
briefing prior to flight training. This item must be included in initial, upgrade, transition, differences, and 
recurrent training. The 737NG and 737 MAX autoland systems are identical and do not require differences 
training unless transitioning between the Fail Passive system and the Fail Operational system. 

9.2.1.4 737 MAX flight control system. The Elevator Jam Landing Assist system and the Landing Attitude 
Modifier (LAM) ground training must address the system functions and associated flight spoiler deployments. 
These items must be included in initial, transition, differences, and recurrent training. 

9.2.1.5 737 MAX FCC. MCAS ground training must address the latest FCC system description, functionality, and 
associated failure conditions to include flight crew alerting. This training must be included in initial, transition, 
differences, and recurrent training. 
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9.2.1.6 HUD. Training must address appropriate ground training elements for both HUD and non-HUD 
operations as specified in Appendix 5, Head-Up Guidance Training. This item must be included in initial, 
upgrade, transition, differences, and recurrent training. 

9.2.1.7 737 MAX gear handle. Gear handles operation to address normal and non-normal procedures. This item 
must be included in initial, transition, differences, and recurrent training. 

9.2.2 Pilots must receive special emphasis on the following areas during flight training. 

9.2.2.1 Automatic landings. When an operator is authorized for autoland operations, flight training must occur 
with the appropriate autopilot (AP) autoland systems (e.g., Fail Operational vs. Fail Passive). This training can 
occur in either a full flight simulator (FFS) or airplane. Flight training must ensure appropriate AFM limitations 
are addressed and complied with. This item must be included in initial, upgrade, transition, differences, and 
recurrent training. The 737NG and 737 MAX autoland systems are identical and do not require differences 
training unless transitioning between the Fail Passive system and the Fail Operational system. 

9.2.2.2 EDFCS. When an EDFCS that supports Fail Operational autoland operations with a Fail Passive Rollout 
system is used, flight training can occur in either an FFS or airplane and should address dual channel AP 
approaches. This item must be included in initial, upgrade, transition, differences, and recurrent training. The 
737NG and 737 MAX autoland systems are identical and do not require differences training unless transitioning 
between the Fail Passive system and the Fail Operational system. 

9.2.2.3 HUD. When HUD is installed and an operator is authorized HUD operations, training must address 
appropriate flight training elements for both HUD and non-HUD operations as specified in Appendix 5. This 
item must be included in initial, upgrade, transition, differences, and recurrent training. 

9.2.2.4 Stabilizer trim. 

9.2.2.4.1 Training must emphasize the following during electric and manual stabilizer trim operations: 

a) Manufacturer recommended procedures for the proper use of main electric stabilizer trim during normal and 
non-normal conditions, and manual stabilizer trim during normal and non-normal conditions; 


b) The different manual trim techniques recommended by the manufacturer; and 


C) The effects of airspeed and aerodynamic loads on the stabilizer and the resulting trim forces in both the nose- 
up and nose-down directions during operations at low and high airspeeds. 


d) Use of manual stabilizer trim during approach, go-around, and level off. 


9.2.2.4.2 Electric and manual stabilizer trim operation during normal and non-normal conditions. This item 
must be included in initial or transition training and must be accomplished at least once every 36 months 
during recurrent training. 

9.2.2.5 Runaway stabilizer. Training must emphasize runaway stabilizer recognition and timely pilot actions 
required by the Runaway Stabilizer NNC. Demonstrate control column functionality and its effect on a runaway 


stabilizer condition. Emphasize the need to attempt to reduce control column forces with main electric 
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stabilizer trim prior to selecting STAB TRIM cutout. This item must be included in initial or transition training 
and must be accomplished at least once every 36 months during recurrent training. 

9.2.2.6 Multiple flight deck alerts during non-normal conditions. Training must include scenario-based training 
where a single malfunction results in multiple flight deck alerts that require timely pilot actions to include 
recognition and interpretation of the non-normal condition and prioritization of the required pilot actions. This 
training must be included in initial, upgrade, transition, and recurrent training. 

9.2.2.7 Unreliable airspeed. This training applies to pilots flying the 737NG, 737 MAX, or conducting 737NG/737 
MAX Mixed Fleet Flying (MFF). Training must include erroneous high angle of attack (AOA) malfunctions. This 
training must also include a demonstration of Flight Director (FD) behavior (biasing out of view) during a go- 
around or missed approach. This item must be included in initial, transition, and differences training and must 
be accomplished at least once every 36 months during recurrent training. Either pilot may serve as pilot flying 
(PF) for this training task. Recurrent training may be accomplished in either a 737NG or 737 MAX FFS. 


Boeing Response to Recommendation 2 


APPENDIX 7- BOEING 737 MAX SPECIAL TRAINING FOR FLIGHTCREWS 

The purpose of this appendix is to describe ground and flight training requirements associated with pilot 
qualification on the 737 MAX. The MDR Table makes reference to this appendix with the use of an asterisk 
(shown as E*). 

No pilot may operate the 737 MAX unless the ground and flight training documented in this appendix has been 
completed. References to "pilots" in this section include both PICs and SICs unless otherwise specified. These 
Special Training segments can be standalone or embedded into another training curriculum. Some tasks 
outlined in this appendix are purposely omitted from Section 9.2, Special Emphasis Areas. The required training 
is as follows: 

1. GROUND TRAINING 


1.1 Training on the following NNCs: 
е Runaway Stabilizer. 
e SPEED TRIM FAIL. 


e STABILIZER OUT OF TRIM. 
• Stabilizer Trim Inoperative. 


e Airspeed Unreliable 
е ALT DISAGREE 


• AOA DISAGREE 
1.2 Training in this section emphasizes the design differences associated with FCC software version P12.1.2 for 
the 737 MAX. This training also emphasizes necessary ground training between the 737NG and 737 MAX with 
FCC software version P12.1.2 or later. Pilots may complete this training by accomplishing the applicable 737 
MAX CBT provided by Boeing or an FAA-approved equivalent. 
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1.2.1 ATA 22 - Autoflight - FCC - MCAS: 

e MCAS function description. 

* Conditions for operation. 

* Erroneous FCC trim commands. 

e Flight deck alerting of the failure of the MCAS function. 
1.2.2 ATA 22 - Autoflight - FCC - AFDS: 

e Automatic AP disengagement. 

е Temporary FD removal. 

е AFDS pitch mode changes following stick shaker. 

e Inhibiting of AP nose up trim. 


1.2.3 ATA 22 - Autoflight - FCC - STAB OUT OF TRIM: 
e Alert illumination logic (ground vs. flight). 
e Revised NNC. 


1.2.4 ATA 22 - Autoflight - FCC - SPEED TRIM FAIL: 
* Function of the SPEED TRIM FAIL light. 
* Revised NNC. 


1.3 Training on the following bullet points that emphasize Boeing-recommended procedures. Pilots may 
complete this training by accomplishing the applicable 737 CBT provided by Boeing or an FAA-approved 
equivalent. 


1.3.1, 737 Manual Trim Operation 

е Manual stabilizer trim operation. 

е Manual stabilizer trimming techniques. 

• Effects of airspeed and aerodynamic loads on manual stabilizer trim operation. 
1.3.2, 737 Unreliable Airspeed - Determining a Reliable Airspeed 

* Recognition of flight deck effects of an unreliable airspeed condition. 

* Memory pitch and thrust settings associated with the NNC. 

* Determination of reliable airspeed indication. 


2. FLIGHT TRAINING 
Training is required to be conducted in a 737 MAX Level C or D FFS. The following bullet points emphasize the 
objectives of each maneuver. This training applies to pilots flying the 737 MAX, or conducting 737NG/737 MAX 
MFF. A 737NG Level C or D FFS may be used for some conditions where noted below. 
2.1 Demonstration of MCAS activation accomplished by each pilot acting as PF. 
2.1.1 MCAS activation during an impending stall (or full stall) and recovery demonstration during manual flight 
in a clean configuration. 
2.1.2 Demonstrate MCAS activation stabilizer trim responses: 

e Stabilizer trim in the nose down direction when above threshold AOA for MCAS activation during stall. 
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е Stabilizer trim in the nose up direction when below threshold AOA for MCAS activation during 
recovery. 
2.2 Runaway stabilizer condition requiring use of manual stabilizer trim accomplished by each pilot acting as 
PF. 
2.2.1 Runaway stabilizer training as described in subparagraph 9.2.2.5. 
2.2.2 Operation of each manual trim technique (as defined by Boeing). 
2.2.3 This training can be completed in a 737 MAX or 737NG FFS. 
2.3 Use of manual stabilizer trim during approach, go-around, and level off accomplished by pilot acting as PF. 
2.3.1 Use of manual stabilizer trim as described in subparagraph 9.2.2.4. 
2.3.2 This training can be completed in a 737 MAX or 737NG FFS. 
2.4 A Cross-FCC Trim Monitor activation demonstration accomplished by either pilot acting as PF. 
2.4.1 Condition must terminate in a landing in order to demonstrate the updated STAB OUT OF TRIM 
light functionality. 
2.5 Erroneous high AOA during takeoff that leads to an unreliable airspeed condition accomplished by either 
pilot acting as PF. 
2.5.1 Demonstrates flight deck effects (i.e., aural, visual, and tactile) associated with the failure. 
2.5.2 Fault occurring during the takeoff procedure. 
2.5.3 Mustinclude a go-around or missed approach flown with erroneous high AOA condition. 
2.5.3.1 Special emphasis placed on FD behavior biasing out of view upon selecting takeoff/go-around 
(TO/GA). 


Boeing Response to Recommendation 3 
737 RTS summary (11-18-2020) 


13.1 Safety Issue #1: Use of Single Angle of Attack (AOA) Sensor 

In the original design, erroneous data from a single AOA sensor activated MCAS and subsequently caused 
airplane nose-down trim of the horizontal stabilizer. In the new design, Boeing eliminated MCAS reliance on a 
single AOA sensor signal by using both AOA sensor inputs and through flight-control law changes that include 
safeguards against failed or erroneous AOA indications. The updated FCC software with revised flight-control 
laws uses inputs from both AOA sensors to activate MCAS. This is in contrast to the original MCAS design, which 
relied on data from only one sensor at a time, and allowed repeated MCAS activation as a result of input from a 
single AOA sensor. The updated FCC software compares the inputs from the two sensors to detect a failed AOA 
sensor. If the difference between the AOA sensor inputs is above a calculated threshold, the FCC will disable the 
STS, including its MCAS function, for the remainder of that flight and provide a corresponding indication of such 
deactivation on the flight deck. Other safety issues are also included in 737RTS summary (11-18-20). 
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Boeing Response to Recommendation 4 


737 RTS summary (11-18-2020) 


The Cross-FCC Trim Monitor is a new feature to address Safety Item #6: OTHER POSSIBLE FCC STABILIZER 
RUNAWAY FAILURES and provides additional protection against erroneous FCC trim commands caused by 
postulated failures in the FCC Lane 2 CPU or I/O chips. Boeing implemented cross FCC Trim Monitor, which can 
effectively detect and shut down erroneous stabilizer commands from the FCCs. This makes continued safe 
flight and landing for this type of failure not dependent on pilot reaction time.This monitor is implemented in 
Lane 2 of the FCC. 

While the FCCs are powered, each FCC continuously monitors the other FCC channel, except during dual- 
channel autopilot operation or when a Fail-operational configured airplane is performing an Autoland or 
automatic Go-Around. The FCC channel in which the autopilot or CWS is engaged, or which is the STS selected 
channel, is referred to as the operational FCC channel. The other FCC channel is referred to as the standby FCC 
channel. 

The monitor compares the trim-up and trim-down command outputs from both FCCs with its own trim 
command calculation. The operational channel performs its normal stabilizer trim-command calculations for 
use by the monitor. The standby channel switches its data sources to use the same data as the operational 
channel to perform its stabilizer-command calculations for use by its monitor. 


Boeing Response to Recommendation 5 


737 Summary (11-18-2020) 


Boeing completed individual safety assessments on the Enhanced Digital Flight Control System (EDFCS) and 
Stabilizer to show that those systems’ designs meet the reliability and integrity safety requirements for 
the737MAX. Assessments include Failure Mode Effects Analysis, Functional Hazard Assessments and Fault Tree 
Analysis. In addition to the individual safety assessments, Boeing developed an integrated System Safety 
Analysis (SSA) for the Speed Trim System with an emphasis on MCAS, including upstream and downstream 
interfaces. The integrated SSA was developed to aid in the showing and finding of compliance based on the 
integration of the systems noted above and their relation to each other. This decision meant the FAA had to 
review and cross reference systems without relying on Boeing’s computer-aided design tools. The integrated 
SSA enabled the FAA to trace systems and make safety determinations using a single document that integrated 
the analysis, rather than simultaneous tracing through multiple documents. 

Reliance on Pilot Mitigations the FAA’s review of the integrated SSA included an evaluation of Boeing’s STS 
design changes to determine if any STS failure modes rely on pilot reaction times to maintain safe operation of 
the airplane . The FAA’s review of the integrated SSA and validated through extensive failure modes testing in 
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simulators, the FAA concluded that no STS failure modes rely on exceptional piloting skills, and do not rely on 
immediate pilot actions. (See 8.3.2, 8.5, 8.6, and 9.1 of this report) 

Single Point Failures 

The FAA's review of the integrated SSA included an evaluation of Boeing's STS design changes. The FAA's 
review determined that there is no evidence that STS functionality is vulnerable to any other single-point 
failures, which can result in a catastrophic outcome. 


Boeing Response to Recommendation 6 


737 RTS summary (11-18-2020) 


In the original design, when a continuous erroneous high AOA sensor value existed, the MCAS control law used 
pilot release of the electric trim switch to reset MCAS activation. Once reset, the MCAS system would 
makeanother airplane nose-down stabilizer trim command after five seconds. This scenario would repeat each 
time the MCAS made a command and the pilot made an electric trim command of any duration and released the 
trim switch. In the new design, Boeing included flight-control law changes to ensure that MCAS will not 
command repeated movements of the horizontal stabilizer. The revised flight control laws allow only an 
activation of MCAS per sensed high-AOA event. A subsequent activation of MCAS is only possible after the 
airplane returns to a low AOA state, below the threshold that would cause MCAS activation. 


ATTACHMENT1: NTSB, BEA 
Comments by US National Transportation Safety Board and French Bureau D’enquétes Et D’ Analyses Pour La 
Sécurité De L’aviation Civile (BEA), 


http://aib.gov.et/wp- 


content/uploads/2020/documents/accident/ET302 NTSBcomments 21June final.pdf 
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ET302 Preliminary FDR Data 
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ATTACHMENT2: ET -AVJ GENERAL VIEW OF FDR DATA 
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General Overview of Flight 


Accident #: Al-01/19 
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ATTACHMENT3: GENERAL VIEW OF FLIGHT 
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Control Column Force Related Parameters 
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ATTACHMENT4: CONTROL COLUMN FORCE RELATED PARAMETERS 
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Flight Deck Displayed Differences 
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ATTACHMENTS: FD DISPLAYED DIFFERENCES 
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ATTACHMENTS: ET- AVJ FLIGHT PROFILE 


330 


Aircraft Accident Investigation Report B737- МАХ 8, ET-AVJ December 2022 


ET-AVJ 


Flight of the event - Ground track 
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